Arraytics
Vulnerability activity for Arraytics: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 12
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 28
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 28
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.3MediumOct 30, 2026Arraytics Booktics Auth bypass / access controlCVE-2026-62122Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
- 4.3MediumOct 30, 2026Arraytics Booktics Auth bypass / access controlCVE-2026-104674Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
- 5.3MediumOct 30, 2026Arraytics Timetics Auth bypass / access controlCVE-2026-116860Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.
- 7.1HighOct 24, 2026Arraytics WP Event Solution XSSCVE-2026-112844Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
- 5.3MediumOct 20, 2026Arraytics Booktics Auth bypass / access controlCVE-2026-112829Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.
- 7.1HighOct 18, 2026Arraytics Booktics XSSCVE-2026-109895Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.
- 9.3CriticalOct 18, 2026Arraytics Booktics SQL injectionCVE-2026-109894Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
- 5.3MediumOct 16, 2026Arraytics WP Event Solution Auth bypass / access controlCVE-2026-110380Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.
- 5.3MediumOct 13, 2026Arraytics WP Event Solution Auth bypass / access controlCVE-2026-109898Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
- 5.4MediumOct 12, 2026Arraytics Booktics Auth bypass / access controlCVE-2026-107418Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- 5.3MediumOct 12, 2026Arraytics Booktics Auth bypass / access controlCVE-2026-108477Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- 4.3MediumOct 7, 2026Arraytics Booktics Auth bypass / access controlCVE-2026-104390Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
- 6.5MediumOct 6, 2026Arraytics WP Event Solution Auth bypass / access controlCVE-2026-97300Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.
- 6.5MediumOct 5, 2026Arraytics Timetics Auth bypass / access controlCVE-2026-97304Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.
- 5.3MediumOct 5, 2026Arraytics WP Event Solution Information disclosureCVE-2026-105073Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
- 5.3MediumOct 5, 2026Arraytics WP Event Solution Auth bypass / access controlCVE-2026-103684Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
- 7.5HighOct 3, 2026Arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System Path traversal / file handlingCVE-2026-75028The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve co
- 5.3MediumOct 3, 2026Arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System Auth bypass / access controlCVE-2026-11601The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with
- 7.5HighSep 15, 2026Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Privilege escalationCVE-2026-75983The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specifi
- 6.4MediumSep 15, 2026Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce XSSCVE-2026-15402The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- 5.3MediumSep 11, 2026Arraytics Booktics Auth bypass / access controlCVE-2026-62135Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
- 5.3MediumSep 11, 2026Arraytics Booktics – Appointment Booking Calendar for Service Businesses Auth bypass / access controlCVE-2026-11446The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, wit
- 5.4MediumSep 9, 2026Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Auth bypass / access controlCVE-2026-11821The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administ
- 7.5HighSep 9, 2026Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Path traversal / file handlingCVE-2026-15667The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive dat
- 7.5HighSep 9, 2026Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Path traversal / file handlingCVE-2026-15406The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or
- 5.3MediumSep 9, 2026Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Auth bypass / access controlCVE-2026-12956The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist
- 6.5MediumSep 3, 2026Arraytics Timetics Auth bypass / access controlCVE-2026-84215Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
- 8.5HighAug 13, 2026Arraytics Booktics SQL injectionCVE-2026-28002Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
Top products
- Booktics10 CVEs in the last year, 1 critical
- WP Event Solution6 CVEs in the last year
- Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce6 CVEs in the last year
- Timetics3 CVEs in the last year
- WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System2 CVEs in the last year
- Booktics – Appointment Booking Calendar for Service Businesses1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.