# cve.now: Arraytics

The newest entries naming Arraytics as an affected vendor (up to 200), of 80 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109994](https://cve.now/CVE-2026-109994.md): Eventin \<= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter (CVSS 6.5)
- [CVE-2026-104674](https://cve.now/CVE-2026-104674.md): WordPress Booktics plugin \<= 1.0.31 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-62122](https://cve.now/CVE-2026-62122.md): WordPress Booktics plugin \<= 1.0.31 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-116860](https://cve.now/CVE-2026-116860.md): WordPress Timetics plugin \<= 1.0.65 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-112844](https://cve.now/CVE-2026-112844.md): WordPress WP Event Solution plugin \<= 4.1.26 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-112829](https://cve.now/CVE-2026-112829.md): WordPress Booktics plugin \<= 1.0.30 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-109895](https://cve.now/CVE-2026-109895.md): WordPress Booktics plugin \<= 1.0.29 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-109894](https://cve.now/CVE-2026-109894.md): WordPress Booktics plugin \<= 1.0.29 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-110380](https://cve.now/CVE-2026-110380.md): WordPress WP Event Solution plugin \<= 4.1.26 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-109898](https://cve.now/CVE-2026-109898.md): WordPress WP Event Solution plugin \<= 4.1.25 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-107418](https://cve.now/CVE-2026-107418.md): WordPress Booktics plugin \<= 1.0.28 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-108477](https://cve.now/CVE-2026-108477.md): WordPress Booktics plugin \<= 1.0.28 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-104390](https://cve.now/CVE-2026-104390.md): WordPress Booktics plugin \<= 1.0.27 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-97300](https://cve.now/CVE-2026-97300.md): WordPress WP Event Solution plugin \<= 4.1.25 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-97304](https://cve.now/CVE-2026-97304.md): WordPress Timetics plugin \<= 1.0.63 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-103684](https://cve.now/CVE-2026-103684.md): WordPress WP Event Solution plugin \<= 4.1.25 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-105073](https://cve.now/CVE-2026-105073.md): WordPress WP Event Solution plugin \<= 4.1.25 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-11601](https://cve.now/CVE-2026-11601.md): WPCafe \<= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete (CVSS 5.3)
- [CVE-2026-75028](https://cve.now/CVE-2026-75028.md): WPCafe \<= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food\_menu\_style' Elementor Widget Setting (CVSS 7.5)
- [CVE-2026-75983](https://cve.now/CVE-2026-75983.md): Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce \<= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map\_meta\_cap Filter (CVSS 7.5)
- [CVE-2026-15402](https://cve.now/CVE-2026-15402.md): Eventin \<= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn\_shedule\_objective' schedule\_slot Parameter (CVSS 6.4)
- [CVE-2026-62135](https://cve.now/CVE-2026-62135.md): WordPress Booktics plugin \<= 1.0.24 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-11446](https://cve.now/CVE-2026-11446.md): Booktics – Booking Calendar for Appointments and Service Businesses \<= 1.0.23 - Missing Authorization (CVSS 5.3)
- [CVE-2026-11821](https://cve.now/CVE-2026-11821.md): Eventin \<= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint (CVSS 5.4)
- [CVE-2026-15667](https://cve.now/CVE-2026-15667.md): Eventin \<= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event\_layout' Parameter (CVSS 7.5)
- [CVE-2026-15406](https://cve.now/CVE-2026-15406.md): Eventin \<= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event\_layout' Parameter (CVSS 7.5)
- [CVE-2026-12956](https://cve.now/CVE-2026-12956.md): Eventin \<= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter (CVSS 5.3)
- [CVE-2026-84215](https://cve.now/CVE-2026-84215.md): WordPress Timetics plugin \<= 1.0.61 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-82223](https://cve.now/CVE-2026-82223.md): WordPress WP Event SOlution plugin \<= 4.1.22 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-28002](https://cve.now/CVE-2026-28002.md): WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-28174](https://cve.now/CVE-2026-28174.md): WordPress WP Event SOlution plugin \<= 4.1.18 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-28173](https://cve.now/CVE-2026-28173.md): WordPress WP Event SOlution plugin \<= 4.1.19 - Arbitrary Content Deletion vulnerability (CVSS 7.1)
- [CVE-2026-66451](https://cve.now/CVE-2026-66451.md): WordPress WP Event SOlution plugin \<= 4.1.9 - Broken Authentication vulnerability (CVSS 6.5)
- [CVE-2026-13039](https://cve.now/CVE-2026-13039.md): Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API (CVSS 5.3)
- [CVE-2026-12924](https://cve.now/CVE-2026-12924.md): Eventin \<= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn\_faq\_content' Parameter (CVSS 6.4)
- [CVE-2026-11818](https://cve.now/CVE-2026-11818.md): WPCafe \<= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API (CVSS 5.4)
- [CVE-2026-57674](https://cve.now/CVE-2026-57674.md): WordPress Timetics plugin \<= 1.0.58 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57621](https://cve.now/CVE-2026-57621.md): WordPress Booktics plugin \<= 1.0.21 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-57622](https://cve.now/CVE-2026-57622.md): WordPress WPCafe plugin \<= 3.0.14 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-68045](https://cve.now/CVE-2025-68045.md): WordPress WP Event SOlution plugin \<= 4.1.12 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-40776](https://cve.now/CVE-2026-40776.md): WordPress Eventin plugin \<= 4.1.8 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-39432](https://cve.now/CVE-2026-39432.md): WordPress Timetics plugin \<= 1.0.53 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2026-4109](https://cve.now/CVE-2026-4109.md): Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) \<= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure (CVSS 4.3)
- [CVE-2026-39585](https://cve.now/CVE-2026-39585.md): WordPress Booktics plugin \<= 1.0.16 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-27071](https://cve.now/CVE-2026-27071.md): WordPress WPCafe plugin \<= 3.0.7 - Broken Access Control vulnerability (CVSS 9.1)
- [CVE-2026-1919](https://cve.now/CVE-2026-1919.md): Booktics \<= 1.0.16 - Missing Authorization to Get Items via REST API endpoints (CVSS 5.3)
- [CVE-2026-1920](https://cve.now/CVE-2026-1920.md): Booktics \<= 1.0.16 - Missing Authorization to Addon Plugin Installation (CVSS 5.3)
- [CVE-2025-68047](https://cve.now/CVE-2025-68047.md): WordPress Eventin plugin \<= 4.1.3 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-14657](https://cve.now/CVE-2025-14657.md): Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) \<= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post\_settings' (CVSS 7.2)
- [CVE-2025-67915](https://cve.now/CVE-2025-67915.md): WordPress Timetics plugin \<= 1.0.46 - Broken Authentication vulnerability (CVSS 8.8)
- [CVE-2025-5919](https://cve.now/CVE-2025-5919.md): Appointment Booking and Scheduling Calendar Plugin – WP Timetics \<= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification (CVSS 6.5)
- [CVE-2025-64268](https://cve.now/CVE-2025-64268.md): WordPress Timetics plugin \<= 1.0.44 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-7813](https://cve.now/CVE-2025-7813.md): Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin \<= 4.0.37 - Unauthenticated Server-Side Request Forgery (CVSS 7.2)
- [CVE-2025-49869](https://cve.now/CVE-2025-49869.md): WordPress Eventin Plugin \<= 4.0.31 - PHP Object Injection Vulnerability (CVSS 8.8)
- [CVE-2025-4796](https://cve.now/CVE-2025-4796.md): Eventin \<= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover (CVSS 8.8)
- [CVE-2025-49321](https://cve.now/CVE-2025-49321.md): WordPress Eventin plugin \<= 4.0.28 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-47539](https://cve.now/CVE-2025-47539.md): WordPress Eventin plugin \<= 4.0.26 - Privilege Escalation Vulnerability (CVSS 9.8)
- [CVE-2025-47445](https://cve.now/CVE-2025-47445.md): WordPress Eventin plugin \<= 4.0.26 - Arbitrary File Download Vulnerability (CVSS 7.5)
- [CVE-2025-3419](https://cve.now/CVE-2025-3419.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.26 - Unauthenticated Arbitrary File Read (CVSS 7.5)
- [CVE-2025-39452](https://cve.now/CVE-2025-39452.md): WordPress WPCafe plugin \<= 2.2.32 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-39584](https://cve.now/CVE-2025-39584.md): WordPress Eventin plugin \<= 4.0.25 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-30829](https://cve.now/CVE-2025-30829.md): WordPress WPCafe plugin \<= 2.2.31 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-30828](https://cve.now/CVE-2025-30828.md): WordPress Timetics plugin \<= 1.0.29 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-1766](https://cve.now/CVE-2025-1766.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update (CVSS 5.3)
- [CVE-2025-1770](https://cve.now/CVE-2025-1770.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.24 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8)
- [CVE-2025-26964](https://cve.now/CVE-2025-26964.md): WordPress Eventin plugin \<= 4.0.20 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2024-56213](https://cve.now/CVE-2024-56213.md): WordPress Eventin plugin \<= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability (CVSS 6.5)
- [CVE-2024-11275](https://cve.now/CVE-2024-11275.md): WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin \<= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion (CVSS 4.3)
- [CVE-2023-47805](https://cve.now/CVE-2023-47805.md): WordPress WPCafe plugin \<= 2.2.22 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2023-49756](https://cve.now/CVE-2023-49756.md): WordPress Eventin plugin \<= 3.3.52 - Authenticated Notice Dismissal Vulnerability (CVSS 5.4)
- [CVE-2024-37427](https://cve.now/CVE-2024-37427.md): WordPress Timetics plugin \<= 1.0.21 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-43923](https://cve.now/CVE-2024-43923.md): WordPress Timetics plugin \<= 1.0.23 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-9263](https://cve.now/CVE-2024-9263.md): WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin \<= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover (CVSS 9.8)
- [CVE-2024-7149](https://cve.now/CVE-2024-7149.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.8 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8)
- [CVE-2024-6033](https://cve.now/CVE-2024-6033.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import (CVSS 4.3)
- [CVE-2024-5431](https://cve.now/CVE-2024-5431.md): WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce \<= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode (CVSS 8.8)
- [CVE-2024-1094](https://cve.now/CVE-2024-1094.md): Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin \<= 1.0.21 - Missing Authorization to Limited Privilege Escalation (CVSS 7.3)
- [CVE-2024-5427](https://cve.now/CVE-2024-5427.md): WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce \<= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode (CVSS 6.4)
- [CVE-2024-1855](https://cve.now/CVE-2024-1855.md): WPCafe \<= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery (CVSS 5.3)
- [CVE-2024-1122](https://cve.now/CVE-2024-1122.md): Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin \<= 3.3.50 - Missing Authorization to Unauthenticated Events Export (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/arraytics
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.