# Eventin vulnerabilities Source: https://junglewise.ai/threats/vendors/eventin Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/eventin.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in Eventin: 1 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-109994, was published on 6 November 2026. 1 vulnerability in the last four weeks, down 50% on the four before (2). ## Counts - Last 7 days: 1 - Last 30 days: 1 - Last 90 days: 9 - All time: 11 (0 critical, 0 exploited in the wild) ## About Eventin Event management and ticketing platform. ## Latest Eventin vulnerabilities - [CVE-2026-109994: Eventin Events Calendar sensitive information exposure in user profile endpoint](https://junglewise.ai/threats/cve-2026-109994-the-eventin-events-calendar-tickets-registration-booking) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-75983: Eventin Event Calendar privilege escalation via map_meta_cap filter](https://junglewise.ai/threats/cve-2026-75983-eventin-event-calendar-privilege-escalation-via-map-meta-cap) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2026-15402: Eventin Event Calendar stored XSS in schedule_slot parameter](https://junglewise.ai/threats/cve-2026-15402-eventin-event-calendar-stored-xss-in-schedule-slot-parameter) (medium, CVSS 6.4, published 15 Sep 2026) - [CVE-2026-15398: WordPress Eventin plugin authorization bypass in order management](https://junglewise.ai/threats/cve-2026-15398-wordpress-eventin-plugin-authorization-bypass-in-order-management) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2026-11821: Eventin Event Calendar authorization bypass in notification workflows](https://junglewise.ai/threats/cve-2026-11821-eventin-event-calendar-authorization-bypass-in-notification) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-15667: Eventin , Event Calendar local file inclusion in event_layout parameter](https://junglewise.ai/threats/cve-2026-15667-eventin-event-calendar-local-file-inclusion-in-event-layout) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2026-84901: WordPress Eventin plugin authorization bypass in REST routes](https://junglewise.ai/threats/cve-2026-84901-wordpress-eventin-plugin-authorization-bypass-in-rest-routes) (medium, CVSS 4.9, published 5 Sep 2026) - [CVE-2026-84898: Eventin WordPress plugin local file inclusion via event layout](https://junglewise.ai/threats/cve-2026-84898-eventin-wordpress-plugin-local-file-inclusion-via-event-layout) (medium, CVSS 6.6, published 5 Sep 2026) - [CVE-2026-13172: Eventin WordPress plugin unauthenticated content disclosure in REST API](https://junglewise.ai/threats/cve-2026-13172-eventin-wordpress-plugin-unauthenticated-content-disclosure-in) (medium, CVSS 5.3, published 26 Aug 2026) - [CVE-2026-13177: Eventin WordPress plugin authorization bypass in order API](https://junglewise.ai/threats/cve-2026-13177-eventin-wordpress-plugin-authorization-bypass-in-order-api) (medium, CVSS 4.3, published 12 Aug 2026) - [CVE-2026-13171: Eventin WordPress plugin authorization bypass in waiting-list handler](https://junglewise.ai/threats/cve-2026-13171-eventin-wordpress-plugin-authorization-bypass-in-waiting-list) (high, CVSS 8.2, published 12 Aug 2026) ## Most severe Eventin vulnerabilities - [CVE-2026-13171: Eventin WordPress plugin authorization bypass in waiting-list handler](https://junglewise.ai/threats/cve-2026-13171-eventin-wordpress-plugin-authorization-bypass-in-waiting-list) (high, CVSS 8.2, published 12 Aug 2026) - [CVE-2026-15667: Eventin , Event Calendar local file inclusion in event_layout parameter](https://junglewise.ai/threats/cve-2026-15667-eventin-event-calendar-local-file-inclusion-in-event-layout) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2026-75983: Eventin Event Calendar privilege escalation via map_meta_cap filter](https://junglewise.ai/threats/cve-2026-75983-eventin-event-calendar-privilege-escalation-via-map-meta-cap) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2026-84898: Eventin WordPress plugin local file inclusion via event layout](https://junglewise.ai/threats/cve-2026-84898-eventin-wordpress-plugin-local-file-inclusion-via-event-layout) (medium, CVSS 6.6, published 5 Sep 2026) - [CVE-2026-109994: Eventin Events Calendar sensitive information exposure in user profile endpoint](https://junglewise.ai/threats/cve-2026-109994-the-eventin-events-calendar-tickets-registration-booking) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-15402: Eventin Event Calendar stored XSS in schedule_slot parameter](https://junglewise.ai/threats/cve-2026-15402-eventin-event-calendar-stored-xss-in-schedule-slot-parameter) (medium, CVSS 6.4, published 15 Sep 2026) - [CVE-2026-11821: Eventin Event Calendar authorization bypass in notification workflows](https://junglewise.ai/threats/cve-2026-11821-eventin-event-calendar-authorization-bypass-in-notification) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-13172: Eventin WordPress plugin unauthenticated content disclosure in REST API](https://junglewise.ai/threats/cve-2026-13172-eventin-wordpress-plugin-unauthenticated-content-disclosure-in) (medium, CVSS 5.3, published 26 Aug 2026) - [CVE-2026-84901: WordPress Eventin plugin authorization bypass in REST routes](https://junglewise.ai/threats/cve-2026-84901-wordpress-eventin-plugin-authorization-bypass-in-rest-routes) (medium, CVSS 4.9, published 5 Sep 2026) - [CVE-2026-15398: WordPress Eventin plugin authorization bypass in order management](https://junglewise.ai/threats/cve-2026-15398-wordpress-eventin-plugin-authorization-bypass-in-order-management) (medium, CVSS 4.3, published 9 Sep 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 50% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 3 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Eventin vulnerabilities", https://junglewise.ai/threats/vendors/eventin, 11 November 2026.