WordPress Vulnerability Scanner WPSec
Vulnerabilities / Events Manager – Calendar, Bookings, Tickets, Appointments and more!

Events Manager – Calendar, Bookings, Tickets, Appointments and more! vulnerabilities

Advisories WPSec published for Events Manager – Calendar, Bookings, Tickets, Appointments and more!. Other sources may list more. Its attack surface: Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-22 WPSEC-2026-1444 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_rsvp_date' Parameter Medium 6.4 7.4.9
2026-10-22 WPSEC-2026-1443 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_search_form Shortcode Label Attributes Medium 6.4 7.4.9
2026-10-22 WPSEC-2026-1442 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Booking Approval Bypass and Authenticated (Subscriber+) Arbitrary Booking Cancellation via 'booking_id' Parameter Mass Assignment Medium 5.3 7.4.9
2026-10-13 WPSEC-2026-0820 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Authenticated (Subscriber+) Sensitive Information Exposure via REST API Tickets Endpoints Medium 4.3 7.4.8
2026-10-13 WPSEC-2026-0819 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Unauthenticated Clickjacking to OAuth Application Authorization Medium 6.8 7.4.8
2026-10-08 WPSEC-2026-0660 Events Manager <= 7.4.6 - Unauthenticated SQL Injection via 'scope' Parameter High 7.5 7.4.7
2026-10-01 WPSEC-2026-0197 Events Manager <= 7.4.3 - Unauthenticated User Interface Misrepresentation via 'client_name' Parameter on OAuth Consent Screen Medium 4.3 7.4.4
2026-10-01 WPSEC-2026-0196 Events Manager <= 7.4.3 - Unauthenticated Insecure Direct Object Reference to Booking Timeslot Capacity Bypass Medium 5.3 7.4.4
2026-10-01 WPSEC-2026-0195 Events Manager <= 7.4.3 - Unauthenticated Sensitive Information Exposure via Password-Protected Events in REST API and iCal Feed Medium 5.3 7.4.4
2026-10-01 WPSEC-2026-0194 Events Manager <= 7.4.3 - Authenticated (Author+) Insecure Direct Object Reference via REST API Media Endpoint Medium 4.3 7.4.4

License: CC BY 4.0