Advisories · Technology
arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce.
Every CVE that names arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- Privilege escalation
- CVSS 6.4 Medium
Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- Broken access control
- CVSS 7.5 High
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- File inclusion
- CVSS 7.5 High
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- File inclusion
- CVSS 5.3 Medium
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- Broken access control