CveMateVulnerability intelligence

Arraytics vulnerabilities

74 vulnerabilities

Known vulnerabilities in Arraytics products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.

Products

12

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)12 vulnerabilities
WP Event Solution11 vulnerabilities
Booktics9 vulnerabilities
Eventin9 vulnerabilities
Timetics9 vulnerabilities
Eventin – Event Calendar, Tickets, Registration, Booking & Woocommerce6 vulnerabilities
Wpcafe – Restaurant Menu, Online Food Ordering & Table Booking System6 vulnerabilities
Wpcafe5 vulnerabilities
Timetics – Appointment Booking & Scheduling4 vulnerabilities
Booktics – Booking Calendar For Appointments And Service Businesses2 vulnerabilities
Booktics – Appointment Booking Calendar For Service Businesses1 vulnerabilities
Wp Timetics1 vulnerabilities

CVE-2026-109895arrayticsbooktics1d ago18-10-2026 11:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.CVE-2026-109894arrayticsbooktics1d ago18-10-2026 11:00

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.CVE-2026-110380arrayticswp event solution3d ago16-10-2026 12:31

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.CVE-2026-109898arrayticswp event solution6d ago13-10-2026 16:23

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.CVE-2026-107418arrayticsbooktics+17d ago12-10-2026 17:12

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.CVE-2026-108477arrayticsbooktics+17d ago12-10-2026 16:32

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.CVE-2025-1770arrayticseventin – event calendar, event registration, tickets & booking (ai powered)+21y ago20-03-2025 05:22

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.CVE-2025-1766arrayticseventin – event calendar, event registration, tickets & booking (ai powered)+21y ago20-03-2025 05:22

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.CVE-2025-68047arrayticseventin+19mo ago22-01-2026 16:52

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.CVE-2025-68045arrayticswp event solution+14mo ago16-06-2026 09:00

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.CVE-2025-26964arrayticseventin+21y ago25-02-2025 14:17

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.20.CVE-2025-47445arrayticseventin+11y ago14-05-2025 11:37

Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.CVE-2025-47539arrayticseventin+21y ago23-05-2025 12:43

Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.CVE-2025-14657arrayticseventin – event calendar, event registration, tickets & booking (ai powered)+19mo ago09-01-2026 07:22

The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded.CVE-2025-4796arrayticseventin – event calendar, event registration, tickets & booking (ai powered)+21y ago08-08-2025 18:26

The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.CVE-2025-39452arrayticswpcafe+11y ago17-04-2025 15:15

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through <= 2.2.32.CVE-2025-39584arrayticseventin+21y ago16-04-2025 12:44

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.25.CVE-2025-7813arrayticseventin – event calendar, event registration, tickets & booking (ai powered)+11y ago23-08-2025 05:48

The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.CVE-2025-67915arrayticstimetics+19mo ago08-01-2026 09:17

Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.CVE-2025-5919arrayticstimetics – appointment booking & scheduling+19mo ago06-01-2026 08:21

The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.