WordPress plugin
Event Espresso – Event Registration & Ticketing Sales security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 5 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium5
- Low0
All Event Espresso – Event Registration & Ticketing Sales vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.5 | Missing Authorization to Unauthenticated Settings Change ≤5.0.37.decafUpdate to 5.0.53.decaf | CVE-2025-68007 | |
| Medium4.3 | Cross-Site Request Forgery ≤5.0.28.decafUpdate to 5.0.31.decaf | CVE-2024-56251 | |
| Medium4.3 | Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification ≤4.10.46.decafUpdate to 5.0.22.decaf | CVE-2024-6883 | |
| Medium5.3 | Feature Bypass ≤4.10.44.decafUpdate to 4.10.45.decaf | CVE-2023-27437 | |
| Medium4.3 | Cross-Site Request Forgery Bypass ≤4.10.11Update to 4.10.12 | CVE-2021-4404 |
- Medium6.5Missing Authorization to Unauthenticated Settings Change
≤5.0.37.decafUpdate to 5.0.53.decaf
- Medium4.3Cross-Site Request Forgery
≤5.0.28.decafUpdate to 5.0.31.decaf
- Medium4.3Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification
≤4.10.46.decafUpdate to 5.0.22.decaf
- Medium5.3Feature Bypass
≤4.10.44.decafUpdate to 4.10.45.decaf
- Medium4.3Cross-Site Request Forgery Bypass
≤4.10.11Update to 4.10.12
Event Espresso – Event Registration & Ticketing Sales: common questions
Does Event Espresso – Event Registration & Ticketing Sales have known vulnerabilities?
Yes. VulnCrest Radar lists 5 known vulnerabilities in Event Espresso – Event Registration & Ticketing Sales: 5 medium. None are known to affect version null.
How do I check which version of Event Espresso – Event Registration & Ticketing Sales I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Event Espresso – Event Registration & Ticketing Sales vulnerability?
CVE-2025-68007, published Jan 15, 2026: Event Espresso 4 Decaf <= 5.0.37.decaf - Missing Authorization to Unauthenticated Settings Change. Severity: Medium (CVSS 6.5).
Is any Event Espresso – Event Registration & Ticketing Sales vulnerability listed in CISA KEV?
No. None of the known Event Espresso – Event Registration & Ticketing Sales vulnerabilities is currently listed in the CISA KEV catalog.