EventPrime – Events Calendar, Bookings, Tickets & AI

Vulnerabilities

• CVE-2026-24378unauthenticated≤ 4.2.8.0

  WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability

  Critical 9.8

• CVE-2024-31275unauthenticated≤ 3.3.4

  WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerability

  Critical 9.8

• CVE-2026-56053subscriber+≤ 4.3.4.1

  WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability

  High 8.8

• CVE-2024-43223login required≤ 4.0.3.2

  WordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerability

  High 8.8

• CVE-2026-42687unauthenticated≤ 4.3.2.1

  WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

  High 8.1

• CVE-2026-42669unauthenticated≤ 4.3.2.0

  WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability

  High 7.5

• CVE-2025-69358unauthenticated≤ 4.2.6.0

  WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability

  High 7.5

• CVE-2026-25312unauthenticated≤ 4.2.8.3

  WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability

  High 7.5

• CVE-2024-24832unauthenticated≤ 3.3.9

  WordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerability

  High 7.5

• CVE-2026-13441unauthenticated≤ 4.3.4.2

  EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

  High 7.2

• CVE-2026-42686subscriber+≤ 4.3.2.1

  WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2026-39518subscriber+≤ 4.3.0.0

  WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability

  High 7.1

• CVE-2024-1123subscriber+≤ 3.4.2

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite

  Medium 6.5

• CVE-2024-12024unauthenticated≤ 4.0.7.3

  EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name

  Medium 6.1

• CVE-2024-9865unauthenticated · needs a click≤ 4.0.4.7

  EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log

  Medium 6.1

• CVE-2024-47648unauthenticated · needs a click≤ 4.0.4.5

  WordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerability

  Medium 6.1

• CVE-2024-1320unauthenticated≤ 3.4.3

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting

  Medium 6.1

• CVE-2023-45637unauthenticated · needs a click≤ 3.1.5

  WordPress EventPrime Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)

  Medium 6.1

• CVE-2023-35884unauthenticated · needs a click≤ 3.0.5

  WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

  Medium 6.1

• CVE-2023-33326unauthenticated · needs a click≤ 2.8.6

  WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

  Medium 6.1

• CVE-2024-1125subscriber+≤ 3.4.3

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

  Medium 5.4

• CVE-2026-25389unauthenticated≤ 4.2.8.3

  WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability

  Medium 5.3

• CVE-2026-1657unauthenticated≤ 4.2.8.4

  EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

  Medium 5.3

• CVE-2026-24380unauthenticated≤ 4.2.8.0

  WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2025-14507unauthenticated≤ 4.2.7.0

  EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API

  Medium 5.3

• CVE-2024-8369unauthenticated≤ 4.0.4.3

  EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure

  Medium 5.3

• CVE-2023-33321unauthenticated≤ 2.8.6

  WordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure

  Medium 5.3

• CVE-2024-1321unauthenticated≤ 3.4.2

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass

  Medium 5.3

• CVE-2024-29776high privilege≤ 3.3.9

  WordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerability

  Medium 4.8

• CVE-2026-1655subscriber+≤ 4.2.8.4

  EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter

  Medium 4.3

• CVE-2025-63007login required≤ 4.2.4.1

  WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerability

  Medium 4.3

• CVE-2025-63006login required≤ 4.2.4.1

  WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability

  Medium 4.3

• CVE-2025-12498subscriber+≤ 4.2.0.0

  EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation

  Medium 4.3

• CVE-2024-13526subscriber+≤ 4.0.7.3

  EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export

  Medium 4.3

• CVE-2024-1127subscriber+≤ 3.4.1

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export

  Medium 4.3

• CVE-2024-1126subscriber+≤ 3.4.2

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval

  Medium 4.3

• CVE-2024-1124subscriber+≤ 3.4.3

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending

  Medium 4.3