VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar security & vulnerabilities

mage-eventpress— active installsLast vulnerability Oct 27, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
37Known vulnerabilities
  • Critical1
  • High9
  • Medium27
  • Low0
Vulnerabilities per year
2021: 2 vulnerabilities2212022: 1 vulnerability1222023: 3 vulnerabilities3232024: 4 vulnerabilities4242025: 10 vulnerabilities10252026: 17 vulnerabilities1726

All Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerabilities

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
≤5.7.8Update to 5.7.9
CVE-2026-109381
Medium4.7Unauthenticated HTML Injection
≤5.7.9Update to 5.7.10
CVE-2026-116394
Medium5.3Missing Authorization
≤5.7.8Update to 5.7.9
CVE-2026-114192
Medium4.35.7.2 - Missing Authorization
5.3.6 – 5.7.2Update to 5.7.3
CVE-2026-91077
Medium5.3Unauthenticated Insecure Direct Object Reference
≤5.3.7Update to 5.3.8
CVE-2026-91008
Medium4.3Missing Authorization
≤5.5.0Update to 5.6.0
CVE-2026-91019
Medium5.3Unauthenticated Insecure Direct Object Reference
≤5.6.0Update to 5.6.4
CVE-2026-81802
Medium4.3Missing Authorization
≤5.5.0Update to 5.6.0
CVE-2026-81759
Medium4.3Missing Authorization
≤5.5.0Update to 5.6.0
CVE-2026-81761
High7.5Authenticated (Contributor+) PHP Object Injection
<5.3.7Update to 5.3.7
CVE-2026-16062
Medium4.3Missing Authorization
<5.3.7Update to 5.3.7
CVE-2026-16064
Medium4.3Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
≤5.3.7Update to 5.3.8
CVE-2026-17166
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤5.3.6Update to 5.3.7
CVE-2026-16063
Medium5.3Missing Authorization
≤5.3.3Update to 5.3.4
CVE-2026-45441
Medium6.1Reflected Cross-Site Scripting
≤5.1.4Update to 5.1.5
CVE-2026-25361
High8.1Unauthenticated PHP Object Injection
≤5.1.1Update to 5.1.2
CVE-2026-23549
Medium4.3Unauthenticated Information Exposure
<5.1.9Update to 5.1.9
CVE-2026-32354
High7.5Authenticated (Contributor+) PHP Object Injection
≤5.0.8Update to 5.0.9
CVE-2026-24954
Medium4.3Cross-Site Request Forgery
≤5.1.1Update to 5.1.2
CVE-2026-24942
Medium5.3Missing Authorization
≤5.0.4Update to 5.0.5
CVE-2025-66083
Medium5.3Missing Authorization
≤5.0.4Update to 5.0.5
CVE-2025-66082
High7.5Authenticated (Contributor+) PHP Object Injection
≤4.4.8Update to 4.4.9
CVE-2025-54742
Medium4.3Missing Authorization
≤4.4.6Update to 4.4.7
CVE-2025-54705
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.4.2Update to 4.4.3
CVE-2025-5568
High8.8Authenticated (Contributor+) PHP Object Injection
≤4.3.6Update to 4.3.7
CVE-2025-32145
High8.8Authenticated (Contributor+) Local File Inclusion
≤4.2.9Update to 4.3.0
CVE-2025-30895
Medium5.3Missing Authorization
≤4.2.9Update to 4.3.0
CVE-2025-30887
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.2.5Update to 4.2.6
CVE-2024-49703
Critical9.9Authenticated (Contributor+) Local File Inclusion
≤4.2.1Update to 4.2.2
CVE-2024-43138
Medium4.3Missing Authorization via handle_optin_optout
≤4.1.2Update to 4.1.3
CVE-2024-32110
High8.8Authenticated (Contributor+) PHP Object Injection in mep_event_meta_save
≤4.1.1Update to 4.1.2
CVE-2024-24796
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function
≤3.8.6Update to 3.8.7
CVE-2023-28422
Medium4.3Cross-Site Request Forgery leading to Uninstall Form Submission
≤3.7.7Update to 3.7.8
CVE-2022-47164
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.7.9Update to 3.8.0
CVE-2023-0144
High8.8SQL Injection
<3.5.8Update to 3.5.8
CVE-2022-0478
Medium5.3Missing Authorization
<3.5.3Update to 3.5.3
—
Medium6.5Arbitrary Settings Change
<3.5.3Update to 3.5.3
—

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar: common questions

Does Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar have known vulnerabilities?

Yes. VulnCrest Radar lists 37 known vulnerabilities in Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar: 1 critical, 9 high, 27 medium. At least one is not fixed in the latest version.

How do I check which version of Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerability?

CVE-2026-109381, published Oct 27, 2026: Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter. Severity: High (CVSS 7.2).

Is any Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerability listed in CISA KEV?

No. None of the known Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?