Events Manager – Calendar, Bookings, Tickets, Appointments and more!

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Events Manager – Calendar, Bookings, Tickets, Appointments and more!

Information

Software Type Plugin
Software Slug events-manager (view on wordpress.org)
Software Status Active
Software Author netweblogic
Software Website wp-events-plugin.com
Software Downloads 6,533,089
Software Active Installs 60,000
Software Record Last Updated October 10, 2026

Showing 1-20 of 49 Vulnerabilities

Submit a Vulnerability
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-42633
Oct 6, 2026
Researcher: neurotx
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure
5.3
CVE-2026-105068
Oct 5, 2026
Researcher: Ananda Dhakal
Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-93662
Sep 22, 2026
Researcher: Karthik Ramakrishnan
Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2026-93661
Sep 22, 2026
Researcher: Hasyros
Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
5.4
CVE-2025-14945
Sep 4, 2026
Researcher: shark3y
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
6.1
CVE-2026-17089
Aug 24, 2026
Researcher: Wordfence PRISM
Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
6.6
CVE-2026-14280
Aug 24, 2026
Researcher: Wordfence PRISM
Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
5.3
CVE-2026-10627
Aug 24, 2026
Researcher: molten bit
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
6.5
CVE-2026-15023
Aug 24, 2026
Researcher: Dmitrii Ignatyev
Events Manager <= 7.4.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-18057
Aug 10, 2026
Researcher: Jakub Herman
Events Manager <= 7.4.0 - Unauthenticated Privilege Escalation
7.3
CVE-2026-18366
Aug 10, 2026
Researcher: Jakub Herman
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-66457
Aug 4, 2026
Researcher: Mukhlis Amien
Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure
5.3
CVE-2026-18050
Jul 30, 2026
Researcher: Usama Arshad
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection
8.1
CVE-2026-57713
Jul 8, 2026
Researcher: dutafi
Events Manager <= 7.3.6 - Unauthenticated SQL Injection
7.5
CVE-2026-12987
Jul 1, 2026
Researcher: Jakub Herman
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
6.4
CVE-2025-12976
Dec 17, 2025
Researcher: Muhammad Yudha - DJ
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion
4.3
CVE-2025-12407
Dec 11, 2025
Researcher: thinnawarth mathuros
Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure
5.3
CVE-2025-12408
Dec 11, 2025
Researcher: thinnawarth mathuros
Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
6.4
CVE-2025-6976
Jul 9, 2025
Researcher: Muhammad Yudha - DJ
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
7.5
CVE-2025-6970
Jul 9, 2025
Researcher: mikemyers
Title Status CVE ID CVSS Researchers Date
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-42633 6.5 neurotx October 6, 2026
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure Patched CVE-2026-105068 5.3 Ananda Dhakal October 5, 2026
Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure Patched CVE-2026-93662 4.3 Karthik Ramakrishnan September 22, 2026
Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference Patched CVE-2026-93661 4.3 Hasyros September 22, 2026
Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes Patched CVE-2025-14945 5.4 shark3y September 4, 2026
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter Patched CVE-2026-17089 6.1 Wordfence PRISM August 24, 2026
Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys Patched CVE-2026-14280 6.6 Wordfence PRISM August 24, 2026
Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters Patched CVE-2026-10627 5.3 molten bit August 24, 2026
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action Patched CVE-2026-15023 6.5 Dmitrii Ignatyev August 24, 2026
Events Manager <= 7.4.0 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-18057 6.5 Jakub Herman August 10, 2026
Events Manager <= 7.4.0 - Unauthenticated Privilege Escalation Patched CVE-2026-18366 7.3 Jakub Herman August 10, 2026
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-66457 7.2 Mukhlis Amien August 4, 2026
Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure Patched CVE-2026-18050 5.3 Usama Arshad July 30, 2026
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection Patched CVE-2026-57713 8.1 dutafi July 8, 2026
Events Manager <= 7.3.6 - Unauthenticated SQL Injection Patched CVE-2026-12987 7.5 Jakub Herman July 1, 2026
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode Patched CVE-2025-12976 6.4 Muhammad Yudha - DJ December 17, 2025
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion Patched CVE-2025-12407 4.3 thinnawarth mathuros December 11, 2025
Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure Patched CVE-2025-12408 5.3 thinnawarth mathuros December 11, 2025
Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes Patched CVE-2025-6976 6.4 Muhammad Yudha - DJ July 9, 2025
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter Patched CVE-2025-6970 7.5 mikemyers July 9, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation