WordPress plugin
EventPrime – Events Calendar, Bookings, Tickets & AI security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 47 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High5
- Medium42
- Low0
All EventPrime – Events Calendar, Bookings, Tickets & AI vulnerabilities
- Medium5.3Missing Authorization
<4.3.6.1Update to 4.3.6.1
- Medium4.3Missing Authorization
≤4.3.6.0Update to 4.3.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
≤4.3.4.2Update to 4.3.4.3
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤4.3.4.1Update to 4.3.4.2
- High8.1Unauthenticated PHP Object Injection
≤4.3.2.1Update to 4.3.2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.3.2.1Update to 4.3.2.2
- Medium5.3Missing Authorization
≤4.3.2.0Update to 4.3.2.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤4.3.0.0Update to 4.3.0.1
- Medium5.3Missing Authorization
≤4.2.8.3Update to 4.2.8.4
- High8.1Unauthenticated PHP Object Injection
≤4.2.8.0Update to 4.2.8.1
- Medium5.3Missing Authorization
≤4.2.6.0Update to 4.2.7.0
- Medium5.3Unauthenticated Information Exposure
≤4.2.8.3Update to 4.2.8.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
≤4.2.8.4Update to 4.2.8.5
- Medium5.3Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint
≤4.2.8.4Update to 4.2.8.5
- Medium5.3Missing Authorization
≤4.2.8.0Update to 4.2.8.1
- Medium5.3Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API
≤4.2.7.0Update to 4.2.8.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
≤4.2.0.0Update to 4.2.0.1
- Medium5.3Missing Authorization
≤4.2.4.1Update to 4.2.5.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤4.2.4.1Update to 4.2.5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Event Attendees Export
≤4.0.7.3Update to 4.0.7.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name
≤4.0.7.3Update to 4.0.7.4
- Medium4.3Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update
≤3.4.9Update to 3.5.0
- Medium6.1Unauthenticated Stored Cross-Site Scripting via Transaction Log
≤4.0.4.7Update to 4.0.4.8
- Medium6.1Unauthenticated Stored Cross-Site Scripting
≤4.0.4.7Update to 4.0.4.8
- Medium6.1Open Redirect
≤4.0.4.5Update to 4.0.4.6
- Medium5.3Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure
≤4.0.4.3Update to 4.0.4.4
- Medium5.3Missing Authorization via calendar_event_create()
≤4.0.3.2Update to 4.0.4.0
- Medium5.3Missing Authorization to Booking Price Maniputlation
≤3.3.4Update to 3.3.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.3.9Update to 3.4.0
- Medium5.3Unauthenticated Booking Payment Bypass
≤3.4.2Update to 3.4.3
- Medium6.5Unauthenticated Stored Cross-Site Scripting
≤3.4.3Update to 3.4.4
- Medium6.5Missing Authorization to Arbitrary Post Overwrite
≤3.4.2Update to 3.4.3
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
≤3.4.3Update to 3.4.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
≤3.4.3Update to 3.4.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval
≤3.4.2Update to 3.4.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Event Export
≤3.4.1Update to 3.4.2
- Medium5.3Improper Input Validation via save_event_booking
≤3.3.9Update to 3.4.0
- Medium5.3Missing Authorization to Private Event Disclosure
≤3.3.5Update to 3.3.6
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.3.2Update to 3.3.3
- Medium5.3Improper Server-Side Checks to Booking Payment Bypass
≤3.3.2Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting via 'event_id'
≤3.1.5Update to 3.1.6
- Medium4.3Reflected HTML Content Injection
<3.2.0Update to 3.2.0
- Medium6.1Reflected Cross-Site Scripting via keyword and ep_filter_date
<3.2.0Update to 3.2.0
- Medium4.3Cross-Site Request Forgery
<3.2.0Update to 3.2.0
- Medium5.3Sensitive Information Exposure
≤2.8.6Update to 3.0.0
- Medium6.1Reflected Cross-Site Scripting
≤2.8.6Update to 3.0.0
- Medium6.1Reflected Cross-Site Scripting
≤3.0.5Update to 3.0.6
EventPrime – Events Calendar, Bookings, Tickets & AI: common questions
Does EventPrime – Events Calendar, Bookings, Tickets & AI have known vulnerabilities?
Yes. VulnCrest Radar lists 47 known vulnerabilities in EventPrime – Events Calendar, Bookings, Tickets & AI: 5 high, 42 medium. None are known to affect version null.
How do I check which version of EventPrime – Events Calendar, Bookings, Tickets & AI I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent EventPrime – Events Calendar, Bookings, Tickets & AI vulnerability?
CVE-2026-118523, published Nov 4, 2026: EventPrime – Events Calendar, Bookings, Tickets & AI < 4.3.6.1 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any EventPrime – Events Calendar, Bookings, Tickets & AI vulnerability listed in CISA KEV?
No. None of the known EventPrime – Events Calendar, Bookings, Tickets & AI vulnerabilities is currently listed in the CISA KEV catalog.