Events Manager

Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.

SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog.

Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated network-accessible attack vector significantly lowers the bar for opportunistic targeting of any WordPress site running this plugin.

Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily stored file uploads without any authorization check, enabling an attacker who has obtained a victim's high-entropy temporary upload identifier to retrieve that user's in-progress file submission. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw represents a missing permission_callback on a WordPress REST route - effectively an IDOR variant against ephemeral upload objects. A public POC is available via WPScan; no CISA KEV listing exists, and the EPSS score of 0.14% (4th percentile) reflects the practical constraint imposed by identifier acquisition being the dominant bottleneck.

Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malicious serialized PHP object through a booking-registration field on sites running No-User-Account Booking Mode. When the stored booking is later loaded, the object is deserialized without a class allow-list, triggering a gadget chain that reaches an unparameterised SQL query and exposes sensitive data such as user password hashes and secret keys. Publicly available exploit code exists (WPScan) and SSVC rates exploitation as PoC and automatable, though it is not listed in CISA KEV.

PHP Object Injection in the WordPress Events Manager plugin (Marcus/@msykes) affects all versions up to and including 7.3.6, letting remote attackers deserialize untrusted data and instantiate arbitrary PHP objects. When paired with a suitable POP gadget chain present in the plugin, WordPress core, or another installed plugin, this can escalate to remote code execution, data theft, or site takeover. Reported by Patchstack with a CVSS of 8.8; there is no public exploit identified at time of analysis and it is not on CISA KEV, though the network vector combined with only requiring user interaction makes it a serious patch priority.

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Events Manager - Calendar, Bookings, Tickets, and more!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Events Manager - Calendar, Bookings, Tickets, and more!. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

The Events Manager - Calendar, Bookings, Tickets, and more!. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Missing Authorization vulnerability in Pixelite Events Manager.4.6.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Events Manager - Calendar, Bookings, Tickets, and more!. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

The Events Manager - Calendar, Bookings, Tickets, and more!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to insufficient input sanitization and output. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. Public exploit code available.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.4.5. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.