Vendor

    Themewinter

    23 known vulnerabilities in products by Themewinter, 0 of them actively exploited (CISA KEV).

    Key figures

    23

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Themewinter
    CriticalCVE-2025-47539

    WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability

    also in 1 other product

    		9.8
    CriticalCVE-2025-47445

    WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

    also in 1 other product

    		7.5
    HighCVE-2024-7149

    Themewinter Eventin: Path Traversal

    also in 1 other product

    		8.8
    HighCVE-2025-1770

    Themewinter Eventin: Path Traversal

    also in 1 other product

    		8.8
    HighCVE-2025-4796

    Themewinter Eventin: Authorization Bypass Through User-Controlled Key

    also in 1 other product

    		8.8
    HighCVE-2025-39584

    WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability

    also in 1 other product

    		7.5
    HighCVE-2025-3419

    Themewinter Eventin: External Control of File Name or Path

    also in 1 other product

    		7.5
    HighCVE-2025-26964

    WordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerability

    also in 1 other product

    		7.5
    HighCVE-2024-5431

    Themewinter WPCafe: PHP Remote File Inclusion

    also in 1 other product

    		8.8
    MediumCVE-2026-66586

    WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

    		6.6
    HighCVE-2024-37513

    WordPress WPCafe plugin <= 2.2.27 - Local File Inclusion vulnerability

    		8.5
    HighCVE-2024-43135

    WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerability

    		7.5
    HighCVE-2024-56213

    WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability

    also in 1 other product

    		6.5
    HighCVE-2023-49756

    WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability

    also in 1 other product

    		5.4
    CriticalCVE-2023-47805

    WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerability

    also in 1 other product

    		5.3
    HighCVE-2025-49321

    WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) Vulnerability

    also in 1 other product

    		7.1
    MediumCVE-2024-1122

    Themewinter Eventin: Missing Authorization

    also in 1 other product

    		5.3
    MediumCVE-2024-1855

    WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery

    also in 1 other product

    		5.3
    MediumCVE-2025-1766

    Themewinter Eventin: Missing Authorization

    also in 1 other product

    		5.3
    MediumCVE-2024-5427

    Themewinter WPCafe: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2024-37507

    WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability

    		6.5
    MediumCVE-2024-39648

    WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

    		5.9
    MediumCVE-2024-6033

    Themewinter Eventin: Missing Authorization

    also in 1 other product

    		4.3

    Products

    Products by Themewinter
    Eventin160
    Themewinter WPCafe60