Events Manager vulnerabilities
We track 4 vulnerabilities in Events Manager products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 12, 2026.
Latest Events Manager vulnerabilities
- 9.8 Critical severity
Events Manager: Improper Privilege Management
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, esca
- 8.1 High severity
Events Manager: Improper Neutralization of Special Elements used in an SQL Command
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent record
- 7.5 High severity
Events Manager: Exposure of Sensitive Information to an Unauthorized Actor
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is k
- 7.5 High severity
Events Manager: Improper Neutralization of Special Elements used in an SQL Command
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed cla