Events Manager (Unknown) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-24. Vendor: Unknown.

CVEs of Events Manager

• CVE-2026-93661 - CVSS 2.7 (low), 2026-09-24: The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against,…
• CVE-2026-93662 - CVSS 4.3 (medium), 2026-09-24: The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner…
• CVE-2026-18366 - CVSS 9.8 (critical), 2026-08-12: The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already…
• CVE-2026-18057 - CVSS 8.1 (high), 2026-08-12: The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with…
• CVE-2026-18050 - CVSS 7.5 (high), 2026-08-06: The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing…
• CVE-2026-12987 - CVSS 7.5 (high), 2026-07-22: The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a…
• CVE-2020-35012 - CVSS 7.2 (high), 2021-12-01: The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection
• CVE-2020-35037 - CVSS 6.1 (medium), 2021-12-01: The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to…