Skip to content
Noroxi

EventPrime

eventprime-event-calendar-management · plugin

Known security vulnerabilities for EventPrime. Find out in seconds which version runs on your site with WP Lens.

37 known vulnerabilities

2 critical · 1 with public exploit code · latest Jul 9, 2026

Vulnerabilities

  • CVE-2026-24378

    WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability

    Critical 9.8

  • CVE-2024-31275

    WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerability

    Critical 9.8

  • CVE-2026-56053

    WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability

    High 8.8

  • CVE-2024-43223

    WordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerability

    High 8.8

  • CVE-2026-42687

    WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

    High 8.1

  • CVE-2026-42669

    WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability

    High 7.5

  • CVE-2025-69358

    WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability

    High 7.5

  • CVE-2026-25312

    WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability

    High 7.5

  • CVE-2024-24832

    WordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerability

    High 7.5

  • CVE-2026-13441

    EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

    High 7.2

  • CVE-2026-42686

    WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-39518

    WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability

    High 7.1

  • CVE-2024-1123

    EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite

    Medium 6.5

  • CVE-2024-12024

    EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name

    Medium 6.1

  • CVE-2024-9865

    EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log

    Medium 6.1

  • CVE-2024-47648

    WordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerability

    Medium 6.1

  • CVE-2024-1320

    EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting

    Medium 6.1

  • CVE-2023-45637

    WordPress EventPrime Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-35884

    WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-33326

    WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2024-1125

    EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

    Medium 5.4

  • CVE-2026-25389

    WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability

    Medium 5.3

  • CVE-2026-1657

    EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

    Medium 5.3

  • CVE-2026-24380

    WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2025-14507

    EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API

    Medium 5.3

  • CVE-2024-8369

    EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure

    Medium 5.3

  • CVE-2023-33321

    WordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure

    Medium 5.3

  • CVE-2024-1321

    EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass

    Medium 5.3

  • CVE-2024-29776

    WordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2026-1655

    EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter

    Medium 4.3

  • CVE-2025-63006

    WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2025-63007

    WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerability

    Medium 4.3

  • CVE-2025-12498

    EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation

    Medium 4.3

  • CVE-2024-13526

    EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export

    Medium 4.3

  • CVE-2024-1127

    EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export

    Medium 4.3

  • CVE-2024-1126

    EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval

    Medium 4.3

  • CVE-2024-1124

    EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending

    Medium 4.3

← Back to directory