RSVP and Event Management
rsvp · plugin
Known security vulnerabilities for RSVP and Event Management. Find out in seconds which version runs on your site with WP Lens.
5 known vulnerabilities
4 exploitable without logging in · latest May 25, 2026
Listed on wordpress.org · latest 2.7.18 · last updated Aug 14, 2026 · 3K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 7.6
CVE-2025-24683high privilege≤ 2.7.14
WordPress RSVP and Event Management Plugin <= 2.7.14 - SQL Injection vulnerability
- Medium 6.1
CVE-2017-18563unauthenticated · needs a click
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
- Medium 5.3
CVE-2026-27398unauthenticated≤ 2.7.16
WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability
- Medium 5.3
CVE-2026-39536unauthenticated≤ 2.7.16
WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerability
- Medium 5.3
CVE-2024-12711unauthenticated≤ 2.7.13
RSVP and Event Management <= 2.7.13 - Missing Authorization
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).