EventPrime – Events Calendar, Bookings and Tickets

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   EventPrime – Events Calendar, Bookings and Tickets

Information

Software Type Plugin
Software Slug eventprime-event-calendar-management (view on wordpress.org)
Software Status Active
Software Author metagauss
Software Website theeventprime.com
Software Downloads 599,073
Software Active Installs 7,000
Software Record Last Updated July 21, 2026

Showing 1-20 of 45 Vulnerabilities

Submit a Vulnerability
EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
7.2
CVE-2026-13441
Jul 8, 2026
Researcher: Philipp Doblhofer
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVE-2026-56053
Jun 25, 2026
Researcher: VanTastic
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection
8.1
CVE-2026-42687
May 25, 2026
Researcher: hhhai
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-42686
May 24, 2026
Researcher: hhhai
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization
5.3
CVE-2026-42669
May 12, 2026
Researcher: Evan NR
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-39518
Apr 20, 2026
Researcher: James Pirstin
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization
5.3
CVE-2026-25312
Mar 18, 2026
Researcher: Dr. M Fahad Khan
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection
8.1
CVE-2026-24378
Mar 17, 2026
Researcher: Phat RiO
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.6.0 - Missing Authorization
5.3
CVE-2025-69358
Mar 10, 2026
Researcher: Nguyen Ba Khanh
EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure
5.3
CVE-2026-25389
Feb 20, 2026
Researcher: Bao - BlueRock
EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
4.3
CVE-2026-1655
Feb 17, 2026
Researcher: Supoj Polsawas (sp0x5ec)
EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint
5.3
CVE-2026-1657
Feb 16, 2026
Researcher: Tharadol Suksamran (d3kc4rt_1)
EventPrime <= 4.2.8.0 - Missing Authorization
5.3
CVE-2026-24380
Jan 28, 2026
Researcher: Bao - BlueRock
EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API
5.3
CVE-2025-14507
Jan 12, 2026
Researcher: Deadbee
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
4.3
CVE-2025-12498
Nov 7, 2025
Researcher: Brian Mungai
EventPrime <= 4.2.4.1 - Missing Authorization
5.3
CVE-2025-63006
Nov 6, 2025
Researcher: daroo
EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2025-63007
Nov 6, 2025
Researcher: daroo
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export
4.3
CVE-2024-13526
Mar 6, 2025
Researcher: Tim Coen
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name
7.2
CVE-2024-12024
Dec 16, 2024
Researcher: zer0gh0st
EventPrime – Events Calendar, Bookings and Tickets <= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update
4.3
CVE-2024-4665
Oct 29, 2024
Researcher: Felipe Caon
Title Status CVE ID CVSS Researchers Date
EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter Patched CVE-2026-13441 7.2 Philipp Doblhofer July 8, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection Patched CVE-2026-56053 7.5 VanTastic June 25, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection Patched CVE-2026-42687 8.1 hhhai May 25, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-42686 6.4 hhhai May 24, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization Patched CVE-2026-42669 5.3 Evan NR May 12, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference Patched CVE-2026-39518 4.3 James Pirstin April 20, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization Patched CVE-2026-25312 5.3 Dr. M Fahad Khan March 18, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection Patched CVE-2026-24378 8.1 Phat RiO March 17, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.6.0 - Missing Authorization Patched CVE-2025-69358 5.3 Nguyen Ba Khanh March 10, 2026
EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure Patched CVE-2026-25389 5.3 Bao - BlueRock February 20, 2026
EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter Patched CVE-2026-1655 4.3 Supoj Polsawas (sp0x5ec) February 17, 2026
EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint Patched CVE-2026-1657 5.3 Tharadol Suksamran (d3kc4rt_1) February 16, 2026
EventPrime <= 4.2.8.0 - Missing Authorization Patched CVE-2026-24380 5.3 Bao - BlueRock January 28, 2026
EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API Patched CVE-2025-14507 5.3 Deadbee January 12, 2026
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation Patched CVE-2025-12498 4.3 Brian Mungai November 7, 2025
EventPrime <= 4.2.4.1 - Missing Authorization Patched CVE-2025-63006 5.3 daroo November 6, 2025
EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure Patched CVE-2025-63007 4.3 daroo November 6, 2025
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export Patched CVE-2024-13526 4.3 Tim Coen March 6, 2025
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name Patched CVE-2024-12024 7.2 zer0gh0st December 16, 2024
EventPrime – Events Calendar, Bookings and Tickets <= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update Patched CVE-2024-4665 4.3 Felipe Caon October 29, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation