Threat Entry Updated 2026-07-13

CVE-2026-13039 - Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) Plugin

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets,…

PLUGIN Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

CVE-2026-13039

MEDIUM CVSS 5.3 2026-07-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-10

CVE-2026-12924 - Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) Plugin

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

CVE-2026-12924

MEDIUM CVSS 6.4 2026-07-10

Risk Score

Open Full Technical Breakdown