These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross-site Scripting vulnerability in WP Event Solution plugin for WordPress allows Stored XSS, affecting versions from n/a through 4.1.26. The vulnerability enables attackers to inject malicious scripts into web pages, potentially impacting website integrity and user trust. Defenders should assess exposure and prioritize patching or mitigation to prevent potential security breaches. This vulnerability [truncated]
The CVE-2026-112829 vulnerability affects the WordPress Booktics plugin, versions up to and including 1.0.30, due to a broken access control issue. This medium-severity vulnerability, with a CVSS score of 5.3, could potentially allow unauthorized access to certain functionality. Defenders should verify the plugin version, monitor activity, and review access configurations to mitigate potential risks. The [truncated]
CVE-2026-109895 is a Cross-site Scripting vulnerability affecting Booktics plugin versions up to 1.0.29. The issue allows for DOM-Based XSS. Defenders should assess exposure, prioritize remediation, and verify inventory. This vulnerability impacts Booktics plugin deployments, allowing attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data breaches. Defend [truncated]
A SQL Injection vulnerability exists in Booktics, a WordPress plugin, from version n/a through 1.0.29. This issue allows attackers to inject malicious SQL code, potentially leading to critical impacts on confidentiality, integrity, and availability. The vulnerability is considered critical, with a CVSS score of 9.3, and defenders should assess exposure and prioritize patching or mitigation efforts to prev [truncated]
The CVE-2026-110380 vulnerability affects the WordPress WP Event Solution plugin, specifically versions up to 4.1.26. This issue is related to a Missing Authorization vulnerability, which allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should assess their exposure, verify the plugin version in use, and r [truncated]
The CVE-2026-107418 vulnerability affects WordPress Booktics plugin versions up to and including 1.0.28, allowing unauthorized actions due to broken access control, with a CVSS score of 5.4 indicating medium severity. Defenders should verify plugin versions, review access controls, and monitor for unauthorized actions. This issue requires attention as it involves broken access control, potentially leading [truncated]
The CVE-2026-108477 vulnerability affects the WordPress Booktics plugin, versions up to and including 1.0.28. This issue is related to broken access control, allowing unauthorized actions. The CVSS score is 5.3, indicating a medium severity level. The vulnerability allows attackers to perform actions without proper authorization, potentially leading to unintended changes or exposure of sensitive informati [truncated]
CVE-2026-105073 is an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution. The issue allows retrieval of embedded sensitive data and affects versions from n/a through 4.1.25. This vulnerability has a CVSS score of 5.3 and is considered medium-severity. Defenders should assess potential exposure and verify version information. The CVE reco [truncated]
A Missing Authorization vulnerability in Arraytics WP Event Solution allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Event Solution: from n/a through 4.1.25. The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or impact is not available. Defenders should assess exposure and prioritize verification and [truncated]
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files.
CVE-2026-62135 is a MEDIUM severity vulnerability in Booktics plugin versions <= 1.0.24. It allows unauthenticated broken access control. Defenders should assess exposure, prioritize remediation, and verify inventory.
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data. A vulnerability exists in all versions up to, and including, 1.0.23 due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true. This, combined with find_and_update_guest() overwriting [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T15:17:20.340Z and has not been modified since then. This unauthenticated broken authentication vulnerability in WP Event Solution plugin versions <= 4.1.9 has a CVSS score of 6.5 and is classified as MEDIUM severity. Users of WP Event Solution plugin versions <= 4.1.9 should verify and apply patc [truncated]
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This regression affects the payment_complete() function in PaymentController.php, allowing unauthenticated attackers to manipulate ticket orders. The vulnerability has a CVSS score of 5.3 and is c [truncated]
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scr [truncated]
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to list, create, update, delete, clone, [truncated]
CVE-2025-68045 is a HIGH severity vulnerability in the WP Event Solution plugin for WordPress. The vulnerability has a CVSS score of 7.5 and is categorized as Unauthenticated Broken Access Control. It affects plugin versions <= 4.1.12.
CVE-2026-40776 is a HIGH severity vulnerability in WP Event SOlution plugin versions <= 4.1.8. The vulnerability has a CVSS score of 7.5 and is categorized as Unauthenticated Broken Access Control. It was published on [cvePublishedAt] and last modified on [cveModifiedAt].
CVE-2025-67915 is an Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics, affecting versions from n/a through <= 1.0.46. The CVE record was published on 2026-01-08T10:15:50.343Z and has not been modified since then. This high-severity vulnerability allows authentication abuse, posing significant risks to Timetics deployments. Defenders and administrators s [truncated]
The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details. The CVE was published on 2026-01-06T09:15:5 [truncated]