Arraytics vulnerabilities

Products

• Booktics 12
• Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) 12
• Timetics 12
• WP Event SOlution 12
• Eventin 9
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 6
• WPCafe 6
• WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 6
• Timetics – Appointment Booking & Scheduling 4
• Booktics – Booking Calendar for Appointments and Service Businesses 2
• Booktics – Appointment Booking Calendar for Service Businesses 1
• Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce 1
• wp timetics 1

Latest Arraytics CVEs

Newest publication first · page 4 of 4

1. CVE-2024-6033 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import

   Published 2024-07-17

   Medium·CVSS 4.3 EPSS 0.36%

   The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authent...

2. CVE-2024-5431 WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode

   Published 2024-06-25

   High·CVSS 8.8 EPSS 0.59%

   The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservation_extra_field shortcode parameter. This makes it possible for a...

3. CVE-2024-1094 Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation

   Published 2024-06-14

   High·CVSS 7.3 EPSS 0.54%

   The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21....

4. CVE-2024-5427 WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode

   Published 2024-05-31

   Medium·CVSS 5.4 EPSS 0.32%

   The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Reservation Form shortcode in all versions up to, and including, 2.2.24 due to insufficient input sani...

5. CVE-2024-1855 WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery

   Published 2024-05-23

   Medium·CVSS 5.3 EPSS 0.44%

   The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpc_check_for_submission function. This makes it possible...

6. CVE-2024-1122 Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export

   Published 2024-02-09

   Medium·CVSS 5.3 EPSS 0.47%

   The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.