Events Manager – Calendar, Bookings, Tickets, Appointments and more!

Уязвимости

• CVE-2015-9298без авторизации

  The events-manager plugin before 5.6 for WordPress has code injection.

  Критич. 9.8

• CVE-2026-57713без авторизации · нужен клик≤ 7.3.6

  WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability

  Высокий 8.8

• CVE-2024-30515нужен вход≤ 6.4.6.4

  WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2025-6970без авторизации≤ 7.0.3

  Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter

  Высокий 7.5

• CVE-2024-11260без авторизации≤ 6.6.3

  Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter

  Высокий 7.5

• CVE-2020-35012админ→ 5.9.8

  Events Manager < 5.9.8 - Admin+ SQL Injection

  Высокий 7.2

• CVE-2026-66457без авторизации · нужен клик≤ 7.4.2

  WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-14280админ≤ 7.3.7.4

  Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

  Средний 6.6

• CVE-2026-15023участник+≤ 7.4.0

  Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action

  Средний 6.5

• CVE-2025-12976участник+≤ 7.2.2.1

  Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode

  Средний 6.4

• CVE-2026-17089без авторизации · нужен клик≤ 7.4.0.1

  Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

  Средний 6.1

• CVE-2025-6975без авторизации · нужен клик≤ 7.0.3

  Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter

  Средний 6.1

• CVE-2023-48326без авторизации · нужен клик≤ 6.4.5

  WordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2020-35037без авторизации · нужен клик→ 5.9.8

  Events Manager < 5.9.8 - Cross-Site Scripting (XSS)

  Средний 6.1

• CVE-2013-7480без авторизации · нужен клик

  The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.

  Средний 6.1

• CVE-2013-7479без авторизации · нужен клик

  The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.

  Средний 6.1

• CVE-2013-7478без авторизации · нужен клик

  The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.

  Средний 6.1

• CVE-2013-7477без авторизации · нужен клик

  The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.

  Средний 6.1

• CVE-2012-6716без авторизации · нужен клик

  The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.

  Средний 6.1

• CVE-2015-9300без авторизации · нужен клик

  The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.

  Средний 6.1

• CVE-2015-9299без авторизации · нужен клик

  The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.

  Средний 6.1

• CVE-2015-9297без авторизации · нужен клик

  The events-manager plugin before 5.6 for WordPress has XSS.

  Средний 6.1

• CVE-2025-14945без авторизации≤ 7.3.3

  Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

  Средний 5.4

• CVE-2019-16523нужен вход

  The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and inserti

  Средний 5.4

• CVE-2018-0576нужен вход

  Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary w

  Средний 5.4

• CVE-2018-9020нужен вход

  The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.

  Средний 5.4

• CVE-2025-6976участник+≤ 7.0.3

  Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

  Средний 5.4

• CVE-2024-3492участник+≤ 6.4.7.3

  Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_cat

  Средний 5.4

• CVE-2024-2111участник+≤ 6.4.7.1

  Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2026-10627без авторизации≤ 7.4.0

  Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters

  Средний 5.3

• CVE-2025-12408без авторизации≤ 7.2.2.2

  Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure

  Средний 5.3

• CVE-2025-1249без авторизации≤ 6.6.4.1

  WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2024-0614админ≤ 6.4.6.4

  Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings

  Средний 4.8

• CVE-2018-13137высокие права

  The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=

  Средний 4.8

• CVE-2025-12407без авторизации · нужен клик≤ 7.2.2.2

  Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion

  Средний 4.3

• CVE-2024-30421без авторизации · нужен клик≤ 6.4.7.1

  WordPress Events Manager plugin <= 6.4.7.1 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 4.3

• CVE-2024-2110без авторизации · нужен клик≤ 6.4.7.1

  Events Manager <= 6.4.7.1 - Cross-Site Request Forgery

  Средний 4.3