CVE-2025-7813highCWE-918

CVE-2025-7813: high-severity vulnerability in arraytics Eventin – Event Calendar, Event…

Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery

Published · Updated

Follow this CVE+ Monitor Eventin – Event Calendar, Event Registration, Tickets & Booking

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.3%
The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
arraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
Related CVEs — arraytics Eventin – Event Calendar, Event…

In the same product, most dangerous first.

CVE-2024-7149HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2025-1770HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File InclusionEPSS 0.9%CVE-2025-3419HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File ReadEPSS 0.7%CVE-2025-4796HIGHEventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account TakeoverEPSS 0.7%CVE-2024-1122MEDIUMEvent Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events ExportEPSS 0.5%CVE-2025-1766MEDIUMEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status UpdateEPSS 0.4%