VulnSea

Arraytics has 25 CVEs on record. Disclosure cadence is accelerating: 24 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 15. The median CVSS is 5.4 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (15) and CWE-79 (3). Most affected products: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (7), booktics (7), wp-event-solution (7).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
0% vs 1% corpus
Median CVSS
5.4
Publish → KEV
—
Last 90 days
24 prev 1

Products

  • Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 7
  • booktics 7
  • wp-event-solution 7
  • WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 2
  • Booktics – Appointment Booking Calendar for Service Businesses 1
  • timetics 1
Follow Arraytics:RSS feedSave a search →Embed badge ↗
25
Total CVEs
1
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

Arraytics vulnerabilities

CVEs affecting Arraytics, newest first. Open any entry for full detail, references, and exploit status.

25 CVEsRSS

CVE-2026-112844High· 7.1
4d ago

WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.

▾ TwilightArraytics · wp-event-solutionEPSS 0.20%via CVEORG
CVE-2026-112829Medium· 5.3
1w ago

WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.

▾ SunlitArraytics · bookticsEPSS 0.29%via CVEORG
CVE-2026-109895High· 7.1
1w ago

WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.

▾ TwilightArraytics · bookticsEPSS 0.18%via CVEORG
CVE-2026-109894Critical· 9.3
1w ago

WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

▾ MidnightArraytics · bookticsEPSS 0.23%via CVEORG
CVE-2026-110380Medium· 5.3
1w ago

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.

▾ SunlitArraytics · wp-event-solutionEPSS 0.17%via NVD
CVE-2026-109898Medium· 5.3
2w ago

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.

▾ SunlitArraytics · wp-event-solutionEPSS 0.17%via NVD
CVE-2026-107418Medium· 5.4
2w ago

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

▾ SunlitArraytics · bookticsEPSS 0.17%via NVD
CVE-2026-108477Medium· 5.3
2w ago

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

▾ SunlitArraytics · bookticsEPSS 0.17%via NVD
CVE-2026-104390Medium· 4.3
3w ago

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.

▾ SunlitArraytics · bookticsEPSS 0.16%via NVD
CVE-2026-97300Medium· 6.5
3w ago

Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.

Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.

▾ SunlitArraytics · wp-event-solutionEPSS 0.21%via NVD
CVE-2026-97304Medium· 6.5
3w ago

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.

▾ SunlitArraytics · timeticsEPSS 0.20%via NVD
CVE-2026-105073Medium· 5.3
3w ago

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.

▾ SunlitArraytics · wp-event-solutionEPSS 0.20%via NVD
CVE-2026-103684Medium· 5.3
3w ago

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.

▾ SunlitArraytics · wp-event-solutionEPSS 0.18%via NVD
CVE-2026-75028High· 7.5
3w ago

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible f…

▾ Twilightarraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking SystemEPSS 0.68%via NVD
CVE-2026-11601Medium· 5.3
3w ago

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a us…

▾ Sunlitarraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking SystemEPSS 0.36%via NVD
CVE-2026-75983High· 7.5
1mo ago

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions…

▾ Twilightarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceEPSS 0.70%via NVD
CVE-2026-15402Medium· 6.4
1mo ago

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, …

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, …

▾ Sunlitarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceEPSS 0.43%via NVD
CVE-2026-62135Medium· 5.3
1mo ago

WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.

▾ SunlitArraytics · bookticsEPSS 0.29%via CVEORG
CVE-2026-11446Medium· 5.3
1mo ago

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() pe…

▾ Sunlitarraytics · Booktics – Appointment Booking Calendar for Service BusinessesEPSS 0.40%via NVD
CVE-2026-15406High· 7.5
1mo ago

Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This mak…

▾ Twilightarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceEPSS 1.1%via CVEORG
CVE-2026-15667High· 7.5PoC
1mo ago

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This mak…

▾ Midnightarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceEPSS 0.96%via NVD
CVE-2026-11821Medium· 5.4
1mo ago

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying th…

▾ Sunlitarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceEPSS 0.33%via NVD
CVE-2026-15398Medium· 4.3
1mo ago

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-82223 Reason: This candidate is a reservation duplicate of CVE-2026-82223. Notes: All CVE users should reference CVE-2026-82223 instead of this candidat…

▾ Sunlitarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommercevia NVD
CVE-2026-12956Medium· 5.3
1mo ago

The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint

The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_it…

▾ Sunlitarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceEPSS 0.41%via NVD
CVE-2025-68045High· 7.5
4mo ago

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.

▾ TwilightArraytics · wp-event-solutionEPSS 0.22%via NVD
Arraytics vulnerabilities (CVEs) · VulnSea