EM
Product
Events Manager – Calendar, Bookings, Tickets, and more!
17
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 15Low 0
Watch
Add Events Manager – Calendar, Bookings, Tickets, and more! to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-6970 | 7.5 | Jul 9 | Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter Affected: through 6.6.4.4; 7.0.1 through 7.0.3 |
| CVE-2024-11260 | 7.5 | Feb 21 | Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter Affected: through 6.6.3 |
| CVE-2026-14280 | 6.6 | Aug 25 | Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys Affected: through 7.3.7.4 |
| CVE-2026-15023 | 6.5 | Aug 25 | Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action Affected: through 7.4.0 |
| CVE-2025-12976 | 6.4 | Dec 18 | Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode Affected: through 7.2.2.1 |
| CVE-2026-17089 | 6.1 | Aug 25 | Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter Affected: through 7.4.0.1 |
| CVE-2025-6975 | 6.1 | Jul 9 | Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter Affected: through 6.6.4.4; 7.0.1 through 7.0.3 |
| CVE-2024-5889 | 6.1 | Jun 29 | Events Manager <= 6.4.8 - Reflected Cross-Site Scripting Affected: through 6.4.8 |
| CVE-2025-14945 | 5.4 | Sep 5 | Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes Affected: through 7.3.3 |
| CVE-2025-6976 | 5.4 | Jul 9 | Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes Affected: through 6.6.4.4; 7.0.1 through 7.0.3 |
| CVE-2024-3492 | 5.4 | Jun 12 | Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes Affected: through 6.4.7.3 |
| CVE-2024-2111 | 5.4 | Mar 28 | Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 6.4.7.1 |
| CVE-2026-10627 | 5.3 | Aug 25 | Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters Affected: through 7.4.0 |
| CVE-2025-12408 | 5.3 | Dec 12 | Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure Affected: through 7.2.2.2 |
| CVE-2024-0614 | 4.8 | Mar 13 | Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings Affected: through 6.4.6.4 |
| CVE-2025-12407 | 4.3 | Dec 12 | Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion Affected: through 7.2.2.2 |
| CVE-2024-2110 | 4.3 | Mar 28 | Events Manager <= 6.4.7.1 - Cross-Site Request Forgery Affected: through 6.4.7.1 |
Showing 17