# Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce

> Events calendar plugin for event registration, event tickets, bookings, RSVP, recurring and virtual events with WooCommerce and Zoom (AI-powered).

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:30 UTC.

## Facts (WordPress.org)

- Slug: `wp-event-solution`
- Author: Arraytics
- Version: 4.1.30
- Active installs: 10,000+
- Last update: 2026-11-01 (12 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.2, PHP 7.4
- Tags: calendar, event registration, Event Tickets, events, events calendar
- Page: https://wordpress.org/plugins/wp-event-solution/

## Checks (against WordPress 7.1.4)

- OK: Updated 12 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Slow ↔ Responsive, Paywalled ↔ Generous, Cluttered ↔ Clean, Locked in ↔ Portable, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-05 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter (up to 4.1.29). CVE-2026-109994, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f890e7b-4255-4d74-b717-bc4c9ad0eea6?source=api-prod
- 2026-10-24 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.1.26). CVE-2026-112844, https://www.wordfence.com/threat-intel/vulnerabilities/id/5eeafbf1-b4b8-4d1d-9932-7a6d23f1cc6f?source=api-prod
- 2026-10-16 MEDIUM: Missing Authorization (up to 4.1.26). CVE-2026-110380, https://www.wordfence.com/threat-intel/vulnerabilities/id/31bc718c-da6e-4022-9383-1f4a86294e16?source=api-prod
- 2026-10-13 MEDIUM: Missing Authorization (up to 4.1.25). CVE-2026-109898, https://www.wordfence.com/threat-intel/vulnerabilities/id/d14275cd-e4fa-4ac7-b9b9-ebe11f89e0bd?source=api-prod
- 2026-10-06 MEDIUM: Missing Authorization (up to 4.1.25). CVE-2026-97300, https://www.wordfence.com/threat-intel/vulnerabilities/id/12a12f2d-c9d0-437c-9cb0-d5fff7a09d5f?source=api-prod
- 2026-10-05 MEDIUM: Missing Authorization (up to 4.1.25). CVE-2026-103684, https://www.wordfence.com/threat-intel/vulnerabilities/id/6ae550c9-b169-41f8-ab0a-b9f30217a518?source=api-prod
- 2026-10-05 MEDIUM: Unauthenticated Information Exposure (up to 4.1.25). CVE-2026-105073, https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c58c0e-40c3-4648-8626-3c827cba1df4?source=api-prod
- 2026-09-16 MEDIUM: Missing Authorization (up to 4.1.23). CVE-2026-77702, https://www.wordfence.com/threat-intel/vulnerabilities/id/cbeff9a1-98e6-467b-83d0-416fdee2a8bf?source=api-prod
- 2026-09-16 MEDIUM: Missing Authorization (up to 4.1.23). CVE-2026-84905, https://www.wordfence.com/threat-intel/vulnerabilities/id/cb731e56-6962-4268-b248-f97d0c7e3bf4?source=api-prod
- 2026-09-16 MEDIUM: Missing Authorization (up to 4.1.23). CVE-2026-84907, https://www.wordfence.com/threat-intel/vulnerabilities/id/021b755f-ebe9-450e-b829-d94f7228990d?source=api-prod
- 2026-09-16 MEDIUM: Unauthenticated Payment Bypass (up to 4.1.23). CVE-2026-84906, https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd9c07e-8711-4ac8-86e1-faf29760fc3a?source=api-prod
- 2026-09-15 MEDIUM: Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter (up to 4.1.23). CVE-2026-15402, https://www.wordfence.com/threat-intel/vulnerabilities/id/a07070b6-37d2-4ccf-ae81-a08ac7b76241?source=api-prod
- 2026-09-15 HIGH: Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter (up to 4.1.23). CVE-2026-75983, https://www.wordfence.com/threat-intel/vulnerabilities/id/ff48db43-9cfa-4dab-b25e-bbc211121f6c?source=api-prod
- 2026-09-09 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter (up to 4.1.22). CVE-2026-12956, https://www.wordfence.com/threat-intel/vulnerabilities/id/5e87a9ac-e7c6-4622-b3e5-6e17e7664317?source=api-prod
- 2026-09-09 HIGH: Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter (up to 4.1.22). CVE-2026-15406, https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b8e5c-d7f2-45d9-ba24-ea7a3d807deb?source=api-prod
- 2026-09-09 HIGH: Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter (up to 4.1.22). CVE-2026-15667, https://www.wordfence.com/threat-intel/vulnerabilities/id/c3001ec4-a1d8-43d7-8e0c-1fe2e4e7f314?source=api-prod
- 2026-09-09 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint (up to 4.1.17). CVE-2026-11821, https://www.wordfence.com/threat-intel/vulnerabilities/id/560a3102-c274-450f-9119-ea47ee2e7c65?source=api-prod
- 2026-09-05 MEDIUM: Authenticated (Contributor+) Path Traversal (before 4.1.21). CVE-2026-84898, https://www.wordfence.com/threat-intel/vulnerabilities/id/67b15479-172d-456b-a8f2-57b71134664d?source=api-prod
- 2026-09-05 MEDIUM: Missing Authorization (before 4.1.22). CVE-2026-84901, https://www.wordfence.com/threat-intel/vulnerabilities/id/a22802aa-e8a4-47eb-9cd7-8663feb5f823?source=api-prod
- 2026-09-02 MEDIUM: Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption (up to 4.1.22). CVE-2026-82223, https://www.wordfence.com/threat-intel/vulnerabilities/id/90408242-562b-4dd7-aa65-eeeb60da178c?source=api-prod
- 2026-08-26 MEDIUM: Unauthenticated Information Exposure (before 4.1.22). CVE-2026-13172, https://www.wordfence.com/threat-intel/vulnerabilities/id/1ccb16c9-7a04-4c8f-9eaa-7efbd84991b3?source=api-prod
- 2026-08-26 MEDIUM: Unauthenticated Order Completion (before 4.1.19). CVE-2026-77694, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c07de1-b722-4252-a5a3-52b12dae72dc?source=api-prod
- 2026-08-21 MEDIUM: Authenticated (Contributor+) Server-Side Request Forgery (before 4.1.21). CVE-2026-13176, https://www.wordfence.com/threat-intel/vulnerabilities/id/dd2d1562-2017-45d1-bbd1-46ffd610e7ac?source=api-prod
- 2026-08-19 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover (up to 4.1.20). CVE-2026-13169, https://www.wordfence.com/threat-intel/vulnerabilities/id/383309cc-d890-4ea6-9e77-5297fd631035?source=api-prod
- 2026-08-19 MEDIUM: Missing Authorization (up to 4.1.20). CVE-2026-13173, https://www.wordfence.com/threat-intel/vulnerabilities/id/a298955e-c8e2-4732-a38e-4f7338a088bc?source=api-prod
- 2026-08-19 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion (up to 4.1.20). CVE-2026-13174, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e2bd61-3187-4992-a3ae-1b5d88d1b90f?source=api-prod
- 2026-08-19 MEDIUM: Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification (up to 4.1.20). CVE-2026-13175, https://www.wordfence.com/threat-intel/vulnerabilities/id/22eda61d-c802-4e9b-a68c-d5ff7d69890c?source=api-prod
- 2026-08-13 MEDIUM: Authenticated (Customer+) Arbitrary Content Deletion (up to 4.1.19). CVE-2026-28173, https://www.wordfence.com/threat-intel/vulnerabilities/id/a3157123-2eea-4f8b-bfc1-07633ad84c2b?source=api-prod
- 2026-08-13 MEDIUM: Authenticated (Customer+) Information Exposure (up to 4.1.18). CVE-2026-28174, https://www.wordfence.com/threat-intel/vulnerabilities/id/003686a7-929b-4c17-bb4b-2a330506819c?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Contributor+) Information Exposure (before 4.1.20). CVE-2026-13168, https://www.wordfence.com/threat-intel/vulnerabilities/id/4169ad47-7b66-433e-8184-cef0d0fec476?source=api-prod
- 2026-08-12 MEDIUM: Unauthenticated User Account Creation (before 4.1.20). CVE-2026-13171, https://www.wordfence.com/threat-intel/vulnerabilities/id/355d8d4a-2488-4da5-b48f-4f8be6b59170?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Contributor+) Information Exposure (before 4.1.20). CVE-2026-13177, https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d584d0-1709-47dd-884b-ad21cac9d537?source=api-prod
- 2026-08-10 MEDIUM: Authenticated (Editor+) Local File Inclusion (up to 4.1.19). CVE-2026-13170, https://www.wordfence.com/threat-intel/vulnerabilities/id/433ab82d-31ce-4386-ab1b-6d3498d7722a?source=api-prod
- 2026-08-06 MEDIUM: Missing Authorization (up to 4.1.9). CVE-2026-66451, https://www.wordfence.com/threat-intel/vulnerabilities/id/cededc46-ebf5-4614-b9d7-2047f70635f7?source=api-prod
- 2026-07-30 MEDIUM: Unauthenticated Payment Bypass (before 4.1.16). CVE-2026-13178, https://www.wordfence.com/threat-intel/vulnerabilities/id/91f025f6-2938-42dc-a70b-4bdfb18cf3b8?source=api-prod
- 2026-07-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter (up to 4.1.15). CVE-2026-12924, https://www.wordfence.com/threat-intel/vulnerabilities/id/343ed594-482a-4a27-9682-92bb643ee82a?source=api-prod
- 2026-07-10 MEDIUM: Missing Authorization to Unauthenticated Payment Bypass via REST API (4.0.26 to 4.1.15). CVE-2026-13039, https://www.wordfence.com/threat-intel/vulnerabilities/id/84a5348a-a307-4db4-83b6-08682282a4b8?source=api-prod
- 2026-06-16 MEDIUM: Missing Authorization (up to 4.1.12). CVE-2025-68045, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b669c19-c8fc-4cb5-b2bc-d9e5c4e08231?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 4.1.8). CVE-2026-40776, https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb7636b-2f4d-4a82-bd63-fea32668530e?source=api-prod
- 2026-04-14 MEDIUM: Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+)... (up to 4.1.8). CVE-2026-4109, https://www.wordfence.com/threat-intel/vulnerabilities/id/87f82d5d-d89a-440d-8c23-ace5160a0739?source=api-prod
- 2026-01-22 HIGH: Authenticated (Contributor+) PHP Object Injection (up to 4.1.3). CVE-2025-68047, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa098a19-6984-4eeb-b8cd-178d0e41e005?source=api-prod
- 2026-01-08 HIGH: Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' (up to 4.0.51). CVE-2025-14657, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5?source=api-prod
- 2025-08-22 HIGH: Unauthenticated Server-Side Request Forgery (up to 4.0.37). CVE-2025-7813, https://www.wordfence.com/threat-intel/vulnerabilities/id/a73f806d-5d64-4df5-b032-3d3a149036ff?source=api-prod
- 2025-08-13 HIGH: Authenticated (Contributor+) PHP Object Injection (up to 4.0.31). CVE-2025-49869, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad2651c-5541-4508-9da1-37838a4df901?source=api-prod
- 2025-08-08 HIGH: Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover (up to 4.0.34). CVE-2025-4796, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e0d441d-1da5-45e7-8a14-ce178099c0cc?source=api-prod
- 2025-06-23 MEDIUM: Reflected Cross-Site Scripting (up to 4.0.28). CVE-2025-49321, https://www.wordfence.com/threat-intel/vulnerabilities/id/d203f477-ca42-40a2-842e-9af98dd9d410?source=api-prod
- 2025-05-07 HIGH: Unauthenticated Arbitrary File Read (up to 4.0.26). CVE-2025-3419, https://www.wordfence.com/threat-intel/vulnerabilities/id/1479071c-85c3-41fd-8ad7-f0dee32f201b?source=api-prod
- 2025-05-07 CRITICAL: Missing Authorization to Unauthenticated Privilege Escalation (up to 4.0.26). CVE-2025-47539, https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbb0146-436f-42fa-802b-cdcf39ae97db?source=api-prod
- 2025-04-16 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 4.0.25). CVE-2025-39584, https://www.wordfence.com/threat-intel/vulnerabilities/id/37d4d038-3f5c-4c4a-b5f1-3dd23a5b345e?source=api-prod
- 2025-03-19 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 4.0.24). CVE-2025-1770, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f24baee-7003-449b-9072-d95fa1e26c8f?source=api-prod
- 2025-03-19 MEDIUM: Missing Authorization to Unauthenticated Payment Status Update (up to 4.0.24). CVE-2025-1766, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2bcaff9-bf04-4d8e-9422-c433264067ff?source=api-prod
- 2025-02-23 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 4.0.20). CVE-2025-26964, https://www.wordfence.com/threat-intel/vulnerabilities/id/70408046-5eb5-4217-9db4-e7b2a7809cf8?source=api-prod
- 2024-12-19 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 4.0.7). CVE-2024-56213, https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b01e96-63e6-4ba0-8c83-f9b05e4050b3?source=api-prod
- 2024-09-26 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 4.0.8). CVE-2024-7149, https://www.wordfence.com/threat-intel/vulnerabilities/id/75537b61-5622-4b35-b80e-389526bd99f0?source=api-prod
- 2024-08-01 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 4.0.5). CVE-2024-39648, https://www.wordfence.com/threat-intel/vulnerabilities/id/b5451529-2e3f-414e-884e-cc6761431262?source=api-prod
- 2024-07-16 MEDIUM: Missing Authorization to Authenticated (Contributor+) Event Data Import (up to 4.0.4). CVE-2024-6033, https://www.wordfence.com/threat-intel/vulnerabilities/id/1725c7f3-2fac-4714-a63e-6c43694483fc?source=api-prod
- 2024-07-04 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 3.3.57). CVE-2024-37507, https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f3de97-5b87-49e4-9239-f405f72b893a?source=api-prod
- 2024-02-08 MEDIUM: Missing Authorization to Unauthenticated Events Export (up to 3.3.50). CVE-2024-1122, https://www.wordfence.com/threat-intel/vulnerabilities/id/0cbdf679-1657-4249-a433-8fe0cddd94be?source=api-prod
- 2023-12-04 MEDIUM: Missing Authorization (up to 3.3.52). CVE-2023-49756, https://www.wordfence.com/threat-intel/vulnerabilities/id/f256036d-11e8-4311-baa0-d15193c72da0?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wp-event-solution · HTML: https://todaywp.com/plugins/wp-event-solution