EM
Product
Events Manager
30
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 6Medium 22Low 1
Watch
Add Events Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-9298 | 9.8 | Aug 13 | The events-manager plugin before 5.6 for WordPress has code injection Affected: before 5.6 |
| CVE-2024-30515 | 8.8 | Jun 9 | Missing Authorization vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.6.4 Affected: before 6.4.7 |
| CVE-2025-6970 | 7.5 | Jul 9 | Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter Affected: before 6.6.5; 7.0.1 before 7.0.4 |
| CVE-2024-11260 | 7.5 | Feb 21 | Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter Affected: before 6.6.4 |
| CVE-2020-35012 | 7.2 | Dec 1 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection Affected: before 5.9.8 |
| CVE-2026-114694 New | 7.1 | Oct 24 | WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability Affected: through 7.4.8 |
| CVE-2026-66457 | 7.1 | Aug 6 | WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability Affected: through 7.4.2 |
| CVE-2025-6975 | 6.1 | Jul 9 | Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter Affected: before 6.6.5; 7.0.1 before 7.0.4 |
| CVE-2024-5889 | 6.1 | Jun 29 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to,… Affected: before 6.4.9 |
| CVE-2023-48326 | 6.1 | Nov 30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.This issue affects Events… Affected: through 6.4.5 |
| CVE-2020-35037 | 6.1 | Dec 1 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues Affected: before 5.9.8 |
| CVE-2013-7480 | 6.1 | Aug 22 | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas Affected: before 5.3.6.1 |
| CVE-2013-7479 | 6.1 | Aug 22 | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field Affected: before 5.3.9 |
| CVE-2013-7478 | 6.1 | Aug 22 | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post Affected: before 5.5 |
| CVE-2013-7477 | 6.1 | Aug 22 | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form Affected: before 5.5.2 |
| CVE-2012-6716 | 6.1 | Aug 22 | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links Affected: before 5.1.7 |
| CVE-2015-9300 | 6.1 | Aug 13 | The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues Affected: before 5.5.7 |
| CVE-2015-9299 | 6.1 | Aug 13 | The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS Affected: before 5.5.7.1 |
| CVE-2015-9297 | 6.1 | Aug 13 | The events-manager plugin before 5.6 for WordPress has XSS Affected: before 5.6 |
| CVE-2025-6976 | 5.4 | Jul 9 | Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes Affected: before 6.6.5; 7.0.1 before 7.0.4 |
| CVE-2024-3492 | 5.4 | Jun 12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'location', and… Affected: before 6.4.8 |
| CVE-2024-2111 | 5.4 | Mar 28 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up… Affected: before 6.4.7.2 |
| CVE-2019-16523 | 5.4 | Oct 16 | The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute… Affected: through 5.9.5 |
| CVE-2018-0576 | 5.4 | May 14 | Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: before 5.9 |
| CVE-2018-9020 | 5.4 | Mar 26 | The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature Affected: before 5.8.1.2 |
| CVE-2026-105068 | 5.3 | Oct 5 | WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability Affected: through 7.4.5 |
| CVE-2024-0614 | 4.8 | Mar 13 | The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to insufficient input… Affected: before 6.4.7 |
| CVE-2018-13137 | 4.8 | Apr 12 | The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI Affected: 5.9.4 |
| CVE-2024-2110 | 4.3 | Mar 28 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1 Affected: before 6.4.7.2 |
| CVE-2026-42689 | 3.7 | Oct 12 | WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability Affected: through 7.4.7 |
Showing 30