SecAlerts
t

themewinter

Security Risk Profile

49
/100
medium

Security Risk Score

Comprehensive risk assessment based on 25 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from February 9, 2024 to present

25
Total CVEs
17
Critical+High
0
Exploited
5
Unpatched

Threat Assessment

Avg CVSS
7.6
Base severity
Avg EPSS
1%
Exploit probability
Unpatched
5
Critical/High
Risk Level
49/100
medium

Severity Distribution

Critical
3
High
14
Medium
8
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
1
<5%
7

Age Distribution

Common Weaknesses (CWE)

1
Path Traversal
6
2
XSS
4
3
SSRF
1

Most Affected Products

1. Themewinter Eventin Wordpress16
2. Themewinter Eventin9
3. WordPress Eventin7
4. Themewinter Wpcafe Wordpress6
5. Themewinter WPCafe3

Recent Vulnerabilities

See more →
CVE-2026-75028
CVSS 7.5high

WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting

Oct 3, 2026🔧 No Patch
CVE-2026-15398
CVSS 4.3medium

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption

Sep 9, 2026🔧 No Patch
CVE-2025-4796
CVSS 8.8high

Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover

Aug 8, 2025🔧 No Patch
CVE-2025-49321
CVSS 7.1high

WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) Vulnerability

Jun 27, 2025
CVE-2025-47539
CVSS 9.8EPSS 6%critical

WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability

May 23, 2025
CVE-2025-47445
CVSS 9.8EPSS 0%critical

WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

May 14, 2025
CVE-2025-3419
CVSS 7.5high

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read

May 8, 2025🔧 No Patch
CVE-2025-39452
CVSS 7.5EPSS 0%high

WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability

Apr 17, 2025
CVE-2025-39584
CVSS 7.5EPSS 0%high

WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability

Apr 16, 2025
CVE-2025-1766
CVSS 5.3medium

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update

Mar 20, 2025🔧 No Patch

Monitor themewinter in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

themewinter Security Vulnerabilities & Risk Score | 25 CVEs | SecAlerts - SecAlerts