Events Manager
Marcus (aka @msykes)
Developer
7.4.12
Latest version
60,000
Installations
No date
Last updated
Vulnerability history
0 present
41 patched
13 Mitigation rules
- Cross Site Scripting (XSS) vulnerability<= 7.4.822/10/2026
- Race Condition vulnerability<= 7.4.812/10/2026
- SQL Injection vulnerability<= 7.4.606/10/2026
- Sensitive Data Exposure vulnerability<= 7.4.505/10/2026
- Subscriber+ Unpublished Event and Location Disclosure vulnerability7.4.1-7.4.424/09/2026
- Contributor+ Arbitrary Ticket Overwrite vulnerability< 7.4.524/09/2026
- WordPress Events Manager - Calendar, Bookings, Tickets, and more! plugin <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes vulnerability<= 7.3.304/09/2026
- Reflected Cross-Site Scripting via 'header_format' Parameter vulnerability<= 7.4.0.128/08/2026
- Unauthenticated Privilege Escalation to Administrator vulnerability< 7.4.128/08/2026
- Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads vulnerability< 7.427/08/2026
- Authenticated (Administrator+) Local File Inclusion vulnerability<= 7.3.7.425/08/2026
- Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability<= 7.4.025/08/2026
- Authenticated (Contributor+) SQL Injection vulnerability<= 7.4.025/08/2026
- Subscriber+ Booking Consent Record Tampering via SQL Injection vulnerability< 7.4.114/08/2026
- Cross Site Scripting (XSS) vulnerability<= 7.4.204/08/2026
- PHP Object Injection vulnerability<= 7.3.608/07/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode vulnerability<= 7.2.2.117/12/2025
- Cross-Site Request Forgery to Location Deletion vulnerability<= 7.2.2.212/12/2025
- Unauthenticated Information Exposure vulnerability<= 7.2.2.212/12/2025
- Reflected Cross Site Scripting (XSS) vulnerability<= 6.6.4.409/07/2025
- Unauthenticated SQL Injection vulnerability<= 6.6.4.409/07/2025
- Cross Site Scripting (XSS) vulnerability<= 6.6.4.409/07/2025
- Broken Access Control vulnerability<= 6.6.4.126/02/2025
- Unauthenticated SQL Injection via Event Status Parameter vulnerability<= 6.6.320/02/2025
- Reflected Cross-Site Scripting vulnerability<= 6.4.801/07/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes vulnerability<= 6.4.7.312/06/2024
- Broken Access Control vulnerability<= 6.4.6.428/03/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 6.4.7.128/03/2024
- Cross-Site Request Forgery vulnerability<= 6.4.7.128/03/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 6.4.7.128/03/2024
- Authenticated(Administator+) Stored Cross-Site Scripting via settings vulnerability<= 6.4.6.429/02/2024
- Reflected Cross Site Scripting (XSS) vulnerability<= 6.4.523/11/2023
- Reflected Cross-Site Scripting (XSS) vulnerability<= 5.9.7.330/11/2020
- SQL Injection (SQLi) vulnerability<= 5.9.7.330/11/2020
- Authenticated Stored Cross-Site Scripting (XSS) vulnerability<= 5.9.8.125/11/2020
- CSV Injection vulnerability<= 5.9.7.107/02/2020
- Unauthenticated Stored XSS vulnerability<= 5.8.1.128/03/2018
- Cross Site Scripting<= 5.5.115/05/2015
- Cross Site Scripting<= 5.3.815/05/2015
- Multiple Cross Site Scripting<= 5.3.515/05/2015
- Multiple XSS<= 5.3.419/01/2013