WordPress plugin
Quick Event Manager security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High2
- Medium8
- Low0
All Quick Event Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | 9.18 - Unauthenticated Unpaid Event Registration Confirmation 9.9.5 – 9.18Update to 9.19 | CVE-2026-121636 | |
| Medium5.3 | 9.18 - Unauthenticated Information Exposure 8.4.6 – 9.18Update to 9.19 | CVE-2026-82214 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤9.18Update to 9.19 | CVE-2026-84848 | |
| Medium5.3 | Missing Authorization ≤9.18Update to 9.19 | CVE-2026-84847 | |
| Medium5.5 | Authenticated(Admin+) Stored Cross-Site Scripting ≤9.6.4Update to 9.6.5 | CVE-2022-46863 | |
| High7.2 | Unauthenticated Stored Cross Site Scripting ≤9.7.4Update to 9.7.5 | CVE-2023-23979 | |
| Medium6.3 | Missing Authorization Checks ≤9.7.4Update to 9.7.5 | CVE-2023-23975 | |
| Medium6.3 | Cross-Site Request Forgery ≤9.7.4Update to 9.7.5 | CVE-2023-23974 | |
| Medium6.1 | Reflected Cross-Site Scripting <9.7.5Update to 9.7.5 | CVE-2023-23491 | |
| Medium6.3 | Missing Authorization Checks all versionsNo patch available | CVE-2022-4974 |
- Medium5.39.18 - Unauthenticated Unpaid Event Registration Confirmation
9.9.5 – 9.18Update to 9.19
- Medium5.39.18 - Unauthenticated Information Exposure
8.4.6 – 9.18Update to 9.19
- High7.2Unauthenticated Stored Cross-Site Scripting
≤9.18Update to 9.19
- Medium5.3Missing Authorization
≤9.18Update to 9.19
- Medium5.5Authenticated(Admin+) Stored Cross-Site Scripting
≤9.6.4Update to 9.6.5
- High7.2Unauthenticated Stored Cross Site Scripting
≤9.7.4Update to 9.7.5
- Medium6.3Missing Authorization Checks
≤9.7.4Update to 9.7.5
- Medium6.3Cross-Site Request Forgery
≤9.7.4Update to 9.7.5
- Medium6.1Reflected Cross-Site Scripting
<9.7.5Update to 9.7.5
- Medium6.3Missing Authorization Checks
all versionsNo patch available
Quick Event Manager: common questions
Does Quick Event Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in Quick Event Manager: 2 high, 8 medium. At least one is not fixed in the latest version.
How do I check which version of Quick Event Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Quick Event Manager vulnerability?
CVE-2026-121636, published Nov 4, 2026: Quick Event Manager 9.9.5 - 9.18 - Unauthenticated Unpaid Event Registration Confirmation. Severity: Medium (CVSS 5.3).
Is any Quick Event Manager vulnerability listed in CISA KEV?
No. None of the known Quick Event Manager vulnerabilities is currently listed in the CISA KEV catalog.