Events Manager – Calendar, Bookings, Tickets, Appointments and more!

Vulnerabilities

• CVE-2015-9298unauthenticated

  The events-manager plugin before 5.6 for WordPress has code injection.

  Critical 9.8

• CVE-2026-57713unauthenticated · needs a click≤ 7.3.6

  WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability

  High 8.8

• CVE-2024-30515login required≤ 6.4.6.4

  WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability

  High 8.8

• CVE-2025-6970unauthenticated≤ 7.0.3

  Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter

  High 7.5

• CVE-2024-11260unauthenticated≤ 6.6.3

  Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter

  High 7.5

• CVE-2020-35012admin→ 5.9.8

  Events Manager < 5.9.8 - Admin+ SQL Injection

  High 7.2

• CVE-2026-66457unauthenticated · needs a click≤ 7.4.2

  WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2026-14280admin≤ 7.3.7.4

  Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

  Medium 6.6

• CVE-2026-15023contributor+≤ 7.4.0

  Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action

  Medium 6.5

• CVE-2025-12976contributor+≤ 7.2.2.1

  Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode

  Medium 6.4

• CVE-2026-17089unauthenticated · needs a click≤ 7.4.0.1

  Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

  Medium 6.1

• CVE-2025-6975unauthenticated · needs a click≤ 7.0.3

  Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter

  Medium 6.1

• CVE-2023-48326unauthenticated · needs a click≤ 6.4.5

  WordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)

  Medium 6.1

• CVE-2020-35037unauthenticated · needs a click→ 5.9.8

  Events Manager < 5.9.8 - Cross-Site Scripting (XSS)

  Medium 6.1

• CVE-2013-7480unauthenticated · needs a click

  The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.

  Medium 6.1

• CVE-2013-7479unauthenticated · needs a click

  The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.

  Medium 6.1

• CVE-2013-7478unauthenticated · needs a click

  The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.

  Medium 6.1

• CVE-2013-7477unauthenticated · needs a click

  The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.

  Medium 6.1

• CVE-2012-6716unauthenticated · needs a click

  The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.

  Medium 6.1

• CVE-2015-9300unauthenticated · needs a click

  The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.

  Medium 6.1

• CVE-2015-9299unauthenticated · needs a click

  The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.

  Medium 6.1

• CVE-2015-9297unauthenticated · needs a click

  The events-manager plugin before 5.6 for WordPress has XSS.

  Medium 6.1

• CVE-2025-14945unauthenticated≤ 7.3.3

  Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

  Medium 5.4

• CVE-2019-16523login required

  The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and inserti

  Medium 5.4

• CVE-2018-0576login required

  Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary w

  Medium 5.4

• CVE-2018-9020login required

  The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.

  Medium 5.4

• CVE-2025-6976contributor+≤ 7.0.3

  Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

  Medium 5.4

• CVE-2024-3492contributor+≤ 6.4.7.3

  Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_cat

  Medium 5.4

• CVE-2024-2111contributor+≤ 6.4.7.1

  Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2026-10627unauthenticated≤ 7.4.0

  Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters

  Medium 5.3

• CVE-2025-12408unauthenticated≤ 7.2.2.2

  Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure

  Medium 5.3

• CVE-2025-1249unauthenticated≤ 6.6.4.1

  WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2024-0614admin≤ 6.4.6.4

  Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings

  Medium 4.8

• CVE-2018-13137high privilege

  The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=

  Medium 4.8

• CVE-2025-12407unauthenticated · needs a click≤ 7.2.2.2

  Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion

  Medium 4.3

• CVE-2024-30421unauthenticated · needs a click≤ 6.4.7.1

  WordPress Events Manager plugin <= 6.4.7.1 - Cross Site Request Forgery (CSRF) vulnerability

  Medium 4.3

• CVE-2024-2110unauthenticated · needs a click≤ 6.4.7.1

  Events Manager <= 6.4.7.1 - Cross-Site Request Forgery

  Medium 4.3