WordPress plugin
Events Manager – Calendar, Bookings, Tickets, Appointments and more! security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High8
- Medium42
- Low0
All Events Manager – Calendar, Bookings, Tickets, Appointments and more! vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting ≤7.4.8Update to 7.4.9 | CVE-2026-114694 | |
| Medium5.3 | Unauthenticated Race Condition ≤7.4.8No patch available | CVE-2026-42689 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection ≤7.4.6Update to 7.4.7 | CVE-2026-42633 | |
| Medium5.3 | Unauthenticated Information Exposure ≤7.4.5Update to 7.4.6 | CVE-2026-105068 | |
| Medium4.3 | Authenticated (Contributor+) Insecure Direct Object Reference ≤7.4.4Update to 7.4.5 | CVE-2026-93661 | |
| Medium4.3 | 7.4.4 - Authenticated (Subscriber+) Information Exposure 7.4.1 – 7.4.4Update to 7.4.5 | CVE-2026-93662 | |
| Medium5.4 | Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes ≤7.3.3Update to 7.3.4 | CVE-2025-14945 | |
| Medium6.1 | Reflected Cross-Site Scripting via 'header_format' Parameter ≤7.4.0.1Update to 7.4.1 | CVE-2026-17089 | |
| Medium6.6 | Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys ≤7.3.7.4Update to 7.4 | CVE-2026-14280 | |
| Medium5.3 | Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters ≤7.4.0Update to 7.4.1 | CVE-2026-10627 | |
| Medium6.5 | Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action ≤7.4.0Update to 7.4.1 | CVE-2026-15023 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection ≤7.4.0Update to 7.4.1 | CVE-2026-18057 | |
| High7.3 | Unauthenticated Privilege Escalation ≤7.4.0Update to 7.4.1 | CVE-2026-18366 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤7.4.2Update to 7.4.3 | CVE-2026-66457 | |
| Medium5.3 | Unauthenticated Pending Upload Disclosure ≤7.3Update to 7.4 | CVE-2026-18050 | |
| High8.1 | Unauthenticated PHP Object Injection ≤7.3.6Update to 7.3.7 | CVE-2026-57713 | |
| High7.5 | Unauthenticated SQL Injection ≤7.3.6Update to 7.3.7 | CVE-2026-12987 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode ≤7.2.2.1Update to 7.2.3 | CVE-2025-12976 | |
| Medium4.3 | Cross-Site Request Forgery to Location Deletion ≤7.2.2.2Update to 7.2.2.3 | CVE-2025-12407 | |
| Medium5.3 | Unauthenticated Information Exposure ≤7.2.2.2Update to 7.2.2.3 | CVE-2025-12408 | |
| Medium6.4 | Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes ≤7.0.3Update to 6.6.5 or 7.0.4 | CVE-2025-6976 | |
| High7.5 | Unauthenticated SQL Injection via `orderby` Parameter ≤7.0.3Update to 6.6.5 or 7.0.4 | CVE-2025-6970 | |
| Medium6.1 | Reflected Cross-Site Scripting via `calendar_header` Parameter ≤7.0.3Update to 6.6.5 or 7.0.4 | CVE-2025-6975 | |
| Medium5.3 | Missing Authorization ≤6.6.4.1Update to 6.6.4.2 | CVE-2025-1249 | |
| High7.5 | Unauthenticated SQL Injection via Event Status Parameter ≤6.6.3Update to 6.6.4 | CVE-2024-11260 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤6.4.8Update to 6.4.9 | CVE-2024-5889 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes ≤6.4.7.3Update to 6.4.8 | CVE-2024-3492 | |
| Medium4.3 | Missing Authorization ≤6.4.6.4Update to 6.4.7 | CVE-2024-30515 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.4.7.1Update to 6.4.7.2 | CVE-2024-30421 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.4.7.1Update to 6.4.7.2 | CVE-2024-2110 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤6.4.7.1Update to 6.4.7.2 | CVE-2024-2111 | |
| Medium4.4 | Authenticated(Administator+) Stored Cross-Site Scripting via settings ≤6.4.6.4Update to 6.4.7 | CVE-2024-0614 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤6.4.5Update to 6.4.6 | CVE-2023-48326 | |
| Medium6.1 | Cross-Site Scripting ≤5.9.7.3Update to 5.9.8 | CVE-2020-35037 | |
| High7.2 | Admin+ SQL Injection ≤5.9.7.3Update to 5.9.8 | CVE-2020-35012 | |
| High7.1 | Unauthenticated CSV Injection <2.6.7.2Update to 2.6.7.2 | — | |
| Medium5.5 | CSV Injection ≤5.9.7.1Update to 5.9.7.2 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting ≤5.9.5Update to 5.9.6 | CVE-2019-16523 | |
| Medium4.8 | Cross-Site Scripting ≤5.9.4Update to 5.9.5 | CVE-2018-13137 | |
| Medium5.4 | Stored Cross-Site Scripting <5.9Update to 5.9 | CVE-2018-0576 | |
| Medium6.4 | Cross-Site Scripting <5.8.1.2Update to 5.8.1.2 | CVE-2018-9020 | |
| Critical9.8 | Code Injection <5.6Update to 5.6 | CVE-2015-9298 | |
| Medium6.1 | Cross-Site Scripting <5.6Update to 5.6 | CVE-2015-9297 | |
| Medium6.1 | Cross-Site Scripting <5.5.7.1Update to 5.5.7.1 | CVE-2015-9299 | |
| Medium6.1 | Cross-Site Scripting <5.5.7Update to 5.5.7 | CVE-2015-9300 | |
| Medium6.1 | Cross-Site Scripting <2.2.9Update to 2.2.9 | CVE-2013-1407 | |
| Medium6.1 | Multiple Cross-Site Scripting ≤5.5.1Update to 5.5.2 | CVE-2013-7477 | |
| Medium6.1 | Cross-Site Scripting <5.3.9Update to 5.3.9 | CVE-2013-7479 | |
| Medium6.1 | Cross-Site Scripting <5.5Update to 5.5 | CVE-2013-7478 | |
| Medium6.1 | Multiple Cross-Site Scripting ≤5.3.6Update to 5.3.6.1 | CVE-2013-7480 | |
| Medium6.1 | Cross-Site Scripting <5.1.7Update to 5.1.7 | CVE-2012-6716 |
- Medium6.1Reflected Cross-Site Scripting
≤7.4.8Update to 7.4.9
- Medium5.3Unauthenticated Race Condition
≤7.4.8No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤7.4.6Update to 7.4.7
- Medium5.3Unauthenticated Information Exposure
≤7.4.5Update to 7.4.6
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
≤7.4.4Update to 7.4.5
- Medium4.37.4.4 - Authenticated (Subscriber+) Information Exposure
7.4.1 – 7.4.4Update to 7.4.5
- Medium5.4Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
≤7.3.3Update to 7.3.4
- Medium6.1Reflected Cross-Site Scripting via 'header_format' Parameter
≤7.4.0.1Update to 7.4.1
- Medium6.6Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
≤7.3.7.4Update to 7.4
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
≤7.4.0Update to 7.4.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
≤7.4.0Update to 7.4.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤7.4.0Update to 7.4.1
- High7.3Unauthenticated Privilege Escalation
≤7.4.0Update to 7.4.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤7.4.2Update to 7.4.3
- Medium5.3Unauthenticated Pending Upload Disclosure
≤7.3Update to 7.4
- High8.1Unauthenticated PHP Object Injection
≤7.3.6Update to 7.3.7
- High7.5Unauthenticated SQL Injection
≤7.3.6Update to 7.3.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
≤7.2.2.1Update to 7.2.3
- Medium4.3Cross-Site Request Forgery to Location Deletion
≤7.2.2.2Update to 7.2.2.3
- Medium5.3Unauthenticated Information Exposure
≤7.2.2.2Update to 7.2.2.3
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
≤7.0.3Update to 6.6.5 or 7.0.4
- High7.5Unauthenticated SQL Injection via `orderby` Parameter
≤7.0.3Update to 6.6.5 or 7.0.4
- Medium6.1Reflected Cross-Site Scripting via `calendar_header` Parameter
≤7.0.3Update to 6.6.5 or 7.0.4
- Medium5.3Missing Authorization
≤6.6.4.1Update to 6.6.4.2
- High7.5Unauthenticated SQL Injection via Event Status Parameter
≤6.6.3Update to 6.6.4
- Medium6.1Reflected Cross-Site Scripting
≤6.4.8Update to 6.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes
≤6.4.7.3Update to 6.4.8
- Medium4.3Missing Authorization
≤6.4.6.4Update to 6.4.7
- Medium4.3Cross-Site Request Forgery
≤6.4.7.1Update to 6.4.7.2
- Medium4.3Cross-Site Request Forgery
≤6.4.7.1Update to 6.4.7.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.4.7.1Update to 6.4.7.2
- Medium4.4Authenticated(Administator+) Stored Cross-Site Scripting via settings
≤6.4.6.4Update to 6.4.7
- Medium6.1Reflected Cross-Site Scripting
≤6.4.5Update to 6.4.6
- Medium6.1Cross-Site Scripting
≤5.9.7.3Update to 5.9.8
- High7.2Admin+ SQL Injection
≤5.9.7.3Update to 5.9.8
- High7.1Unauthenticated CSV Injection
<2.6.7.2Update to 2.6.7.2
- Medium5.5CSV Injection
≤5.9.7.1Update to 5.9.7.2
- Medium6.4Authenticated Stored Cross-Site Scripting
≤5.9.5Update to 5.9.6
- Medium4.8Cross-Site Scripting
≤5.9.4Update to 5.9.5
- Medium5.4Stored Cross-Site Scripting
<5.9Update to 5.9
- Medium6.4Cross-Site Scripting
<5.8.1.2Update to 5.8.1.2
- Critical9.8Code Injection
<5.6Update to 5.6
- Medium6.1Cross-Site Scripting
<5.6Update to 5.6
- Medium6.1Cross-Site Scripting
<5.5.7.1Update to 5.5.7.1
- Medium6.1Cross-Site Scripting
<5.5.7Update to 5.5.7
- Medium6.1Cross-Site Scripting
<2.2.9Update to 2.2.9
- Medium6.1Multiple Cross-Site Scripting
≤5.5.1Update to 5.5.2
- Medium6.1Cross-Site Scripting
<5.3.9Update to 5.3.9
- Medium6.1Cross-Site Scripting
<5.5Update to 5.5
- Medium6.1Multiple Cross-Site Scripting
≤5.3.6Update to 5.3.6.1
- Medium6.1Cross-Site Scripting
<5.1.7Update to 5.1.7
Events Manager – Calendar, Bookings, Tickets, Appointments and more!: common questions
Does Events Manager – Calendar, Bookings, Tickets, Appointments and more! have known vulnerabilities?
Yes. VulnCrest Radar lists 51 known vulnerabilities in Events Manager – Calendar, Bookings, Tickets, Appointments and more!: 1 critical, 8 high, 42 medium. At least one is not fixed in the latest version.
How do I check which version of Events Manager – Calendar, Bookings, Tickets, Appointments and more! I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Events Manager – Calendar, Bookings, Tickets, Appointments and more! vulnerability?
CVE-2026-114694, published Oct 22, 2026: Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Reflected Cross-Site Scripting. Severity: Medium (CVSS 6.1).
Is any Events Manager – Calendar, Bookings, Tickets, Appointments and more! vulnerability listed in CISA KEV?
No. None of the known Events Manager – Calendar, Bookings, Tickets, Appointments and more! vulnerabilities is currently listed in the CISA KEV catalog.