What’s Vulnerable › Products
metagauss EventPrime – Events Calendar, Bookings and Tickets vulnerabilities
45 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.
Check whether your metagauss EventPrime – Events Calendar, Bookings and Tickets version is affected
Latest metagauss EventPrime – Events Calendar, Bookings and Tickets vulnerabilities
- CVE-2026-42691 — WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability (CVSS 5.4)
- CVE-2026-13441 — EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter (CVSS 7.2)
- CVE-2026-56053 — WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability (CVSS 8.8)
- CVE-2026-42687 — WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability (CVSS 8.1)
- CVE-2026-42686 — WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-39518 — WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.1)
- CVE-2026-42669 — WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability (CVSS 7.5)
- CVE-2026-24378 — WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability (CVSS 9.8)
- CVE-2025-69358 — WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability (CVSS 7.5)
- CVE-2026-25312 — WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability (CVSS 7.5)
- CVE-2026-25389 — WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- CVE-2026-1655 — EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter (CVSS 4.3)
- CVE-2026-1657 — EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint (CVSS 5.3)
- CVE-2026-24380 — WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2025-14507 — EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API (CVSS 5.3)
- CVE-2025-63007 — WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- CVE-2025-63006 — WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2025-12498 — EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation (CVSS 4.3)
- CVE-2024-4665 — EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update (CVSS 6.4)
- CVE-2024-13526 — EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export (CVSS 4.3)
- CVE-2024-12024 — EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name (CVSS 6.1)
- CVE-2024-43223 — WordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-9865 — EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log (CVSS 6.1)
- CVE-2024-9864 — EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
- CVE-2024-8369 — EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure (CVSS 5.3)