WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
events-manager
Published
2020-02-05
Title
Events Manager < 5.9.7.2 - CSV Injection
Slug
events-manager
Published
2020-06-07
Title
Events Manager < 5.9.8 - Admin+ SQL Injection
Slug
events-manager
Published
2020-06-07
Title
Events Manager < 5.9.8 - Cross-Site Scripting (XSS)
Slug
events-manager
Published
2023-11-23
Title
Events Manager < 6.4.6 - Reflected Cross-Site Scripting
Slug
events-manager
Published
2024-02-28
Title
Events Manager < 6.4.7 - Authenticated(Administator+) Stored Cross-Site Scripting via settings
Slug
events-manager
Published
2024-03-27
Title
Events Manager < 6.4.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
events-manager
Published
2024-03-27
Title
Events Manager < 6.4.7.2 - Cross-Site Request Forgery
Slug
events-manager
Published
2024-03-28
Title
Events Manager < 6.4.7 - Missing Authorization
Slug
events-manager
Published
2024-03-28
Title
Events Manager < 6.4.7.2 - Cross-Site Request Forgery
Slug
events-manager
Published
2024-06-11
Title
Events Manager – Calendar, Bookings, Tickets, and more! < 6.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes
Slug
events-manager
Published
2024-06-28
Title
Events Manager < 6.4.9 - Reflected Cross-Site Scripting
Slug
events-manager
Published
2025-02-20
Title
Events Manager – Calendar, Bookings, Tickets, and more! < 6.6.4 - Unauthenticated SQL Injection via Event Status Parameter
Slug
events-manager
Published
2025-02-26
Title
Events Manager – Calendar, Bookings, Tickets, and more! < 6.6.4.2 - Missing Authorization
Slug
events-manager
Published
2025-07-09
Title
Events Manager < 7.0.4 - Unauthenticated SQL Injection via `orderby` Parameter
Slug
events-manager
Published
2025-07-09
Title
Event Manager < 7.0.4 - Reflected Cross-Site Scripting via `calendar_header` Parameter
Slug
events-manager
Published
2025-07-09
Title
Events Manager < 7.0.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
Slug
events-manager
Published
2025-12-11
Title
Events Manager < 7.2.2.3 - Unauthenticated Information Exposure
Slug
events-manager
Published
2025-12-11
Title
Events Manager – Calendar, Bookings, Tickets, and more! < 7.2.2.3 - Cross-Site Request Forgery to Location Deletion
Slug
events-manager
Published
2025-12-17
Title
Events Manager < 7.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
Slug
events-manager
Published
2026-07-01
Title
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
Slug
events-manager
Published
2026-07-08
Title
Events Manager – Calendar, Bookings, Tickets, and more! < 7.3.7 - Unauthenticated PHP Object Injection
Slug
events-manager
Published
2026-07-30
Title
Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads
Slug
events-manager
Published
2026-08-04
Title
Events Manager – Calendar, Bookings, Tickets, and more! < 7.4.3 - Unauthenticated Stored Cross-Site Scripting
Slug
events-manager
Published
2026-08-24
Title
Events Manager < 7.4.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
Slug
events-manager
Published
2026-08-10
Title
Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection