Plugin icon

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar

mage-eventpress

Vulnerabilities:

28

Last Updated:

August 18, 2026

Active Installs:

7000

Published
Title
Fixed in
CVSS
Published
2026-07-28
Title
Event Booking Manager for WooCommerce < 5.3.8 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
Fixed in
Fixed in 5.3.8
CVSS
2.7 (low)
Published
2026-07-22
Title
Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content
Fixed in
Fixed in 5.3.7
CVSS
6.8 (medium)
Published
2026-07-22
Title
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content
Fixed in
Fixed in 5.3.7
CVSS
6.6 (medium)
Published
2026-07-22
Title
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event
Fixed in
Fixed in 5.3.7
CVSS
5.5 (medium)
Published
2026-05-26
Title
Event Booking Manager for WooCommerce < 5.3.4 - Missing Authorization
Fixed in
Fixed in 5.3.4
CVSS
5.3 (medium)
Published
2026-03-20
Title
Event Booking Manager for WooCommerce < 5.1.5 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.1.5
CVSS
6.1 (medium)
Published
2026-02-18
Title
WpEvently < 5.1.2 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 5.1.2
CVSS
8.1 (high)
Published
2026-02-14
Title
WpEvently < 5.1.9 - Unauthenticated Information Exposure
Fixed in
Fixed in 5.1.9
CVSS
5.3 (medium)
Published
2025-12-25
Title
WpEvently < 5.0.9 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 5.0.9
CVSS
7.5 (high)
Published
2025-12-06
Title
WpEvently < 5.1.2 - Cross-Site Request Forgery
Fixed in
Fixed in 5.1.2
CVSS
4.3 (medium)
Published
2025-12-04
Title
WpEvently < 5.0.5 - Missing Authorization
Fixed in
Fixed in 5.0.5
CVSS
5.3 (medium)
Published
2025-11-30
Title
WpEvently < 5.0.5 - Missing Authorization
Fixed in
Fixed in 5.0.5
CVSS
5.3 (medium)
Published
2025-08-27
Title
WpEvently < 4.4.9 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 4.4.9
CVSS
7.5 (high)
Published
2025-07-30
Title
WpEvently < 4.4.7 - Missing Authorization
Fixed in
Fixed in 4.4.7
CVSS
4.3 (medium)
Published
2025-06-06
Title
WpEvently < 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.4.3
CVSS
6.4 (medium)
Published
2025-04-08
Title
WpEvently < 4.3.7 - Contributor+ PHP Object Injection
Fixed in
Fixed in 4.3.7
CVSS
6.6 (medium)
Published
2025-03-27
Title
WpEvently < 4.3.0 - Missing Authorization
Fixed in
Fixed in 4.3.0
CVSS
5.3 (medium)
Published
2025-03-27
Title
WpEvently < 4.3.0 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.3.0
CVSS
8.8 (high)
Published
2024-10-21
Title
Event Manager for WooCommerce < 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.2.6
CVSS
6.4 (medium)
Published
2024-08-07
Title
Event Manager for WooCommerce < 4.2.2 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.2.2
CVSS
9.9 (critical)
Published
2024-01-31
Title
Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently < 4.1.2 - Authenticated (Contributor+) PHP Object Injection in mep_event_meta_save
Fixed in
Fixed in 4.1.2
CVSS
8.8 (high)
Published
2023-06-22
Title
Event Manager for WooCommerce < 3.9.6 - Editor+ Stored Cross-Site Scripting
Fixed in
Fixed in 3.9.6
CVSS
5.9 (medium)
Published
2023-03-20
Title
Event Manager for WooCommerce < 3.8.7 - Admin+ Stored XSS
Fixed in
Fixed in 3.8.7
CVSS
3.5 (low)
Published
2023-03-16
Title
Event Manager for WooCommerce < 3.7.8 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 3.7.8
CVSS
4.3 (medium)
Published
2023-01-10
Title
Event Manager and Tickets Selling Plugin for WooCommerce < 3.8.0 - Contributor+ Stored XSS
Fixed in
Fixed in 3.8.0
CVSS
6.8 (medium)
Published
2022-02-21
Title
Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL Injection
Fixed in
Fixed in 3.5.8
CVSS
7.7 (high)
Published
2021-11-03
Title
Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Elementor Template Import
Fixed in
Fixed in 3.5.3
CVSS
5.3 (medium)
Published
2021-11-03
Title
Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Options Reset
Fixed in
Fixed in 3.5.3
CVSS
8.2 (high)