WordPress plugin
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High9
- Medium27
- Low0
All Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter ≤5.7.8Update to 5.7.9 | CVE-2026-109381 | |
| High7.5 | Authenticated (Contributor+) PHP Object Injection <5.3.7Update to 5.3.7 | CVE-2026-16062 | |
| High8.1 | Unauthenticated PHP Object Injection ≤5.1.1Update to 5.1.2 | CVE-2026-23549 | |
| High7.5 | Authenticated (Contributor+) PHP Object Injection ≤5.0.8Update to 5.0.9 | CVE-2026-24954 | |
| High7.5 | Authenticated (Contributor+) PHP Object Injection ≤4.4.8Update to 4.4.9 | CVE-2025-54742 | |
| High8.8 | Authenticated (Contributor+) PHP Object Injection ≤4.3.6Update to 4.3.7 | CVE-2025-32145 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion ≤4.2.9Update to 4.3.0 | CVE-2025-30895 | |
| Critical9.9 | Authenticated (Contributor+) Local File Inclusion ≤4.2.1Update to 4.2.2 | CVE-2024-43138 | |
| High8.8 | Authenticated (Contributor+) PHP Object Injection in mep_event_meta_save ≤4.1.1Update to 4.1.2 | CVE-2024-24796 | |
| High8.8 | SQL Injection <3.5.8Update to 3.5.8 | CVE-2022-0478 |
- High7.2Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
≤5.7.8Update to 5.7.9
- High7.5Authenticated (Contributor+) PHP Object Injection
<5.3.7Update to 5.3.7
- High8.1Unauthenticated PHP Object Injection
≤5.1.1Update to 5.1.2
- High7.5Authenticated (Contributor+) PHP Object Injection
≤5.0.8Update to 5.0.9
- High7.5Authenticated (Contributor+) PHP Object Injection
≤4.4.8Update to 4.4.9
- High8.8Authenticated (Contributor+) PHP Object Injection
≤4.3.6Update to 4.3.7
- High8.8Authenticated (Contributor+) Local File Inclusion
≤4.2.9Update to 4.3.0
- Critical9.9Authenticated (Contributor+) Local File Inclusion
≤4.2.1Update to 4.2.2
- High8.8Authenticated (Contributor+) PHP Object Injection in mep_event_meta_save
≤4.1.1Update to 4.1.2
- High8.8SQL Injection
<3.5.8Update to 3.5.8
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar: common questions
Does Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar have known vulnerabilities?
Yes. VulnCrest Radar lists 37 known vulnerabilities in Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar: 1 critical, 9 high, 27 medium. At least one is not fixed in the latest version.
How do I check which version of Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerability?
CVE-2026-109381, published Oct 27, 2026: Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter. Severity: High (CVSS 7.2).
Is any Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerability listed in CISA KEV?
No. None of the known Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar vulnerabilities is currently listed in the CISA KEV catalog.