What’s Vulnerable › Products
netweblogic Events Manager – Calendar, Bookings, Tickets, and more! vulnerabilities
45 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 22 published in the last 12 months.
Latest netweblogic Events Manager – Calendar, Bookings, Tickets, and more! vulnerabilities
- CVE-2026-114694 — WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-42689 — WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability (CVSS 3.7)
- CVE-2026-105068 — WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- CVE-2026-93662 — Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter (CVSS 4.3)
- CVE-2026-93661 — Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR (CVSS 2.7)
- CVE-2025-14945 — Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes (CVSS 5.4)
- CVE-2026-17089 — Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter (CVSS 6.1)
- CVE-2026-14280 — Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys (CVSS 6.6)
- CVE-2026-10627 — Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters (CVSS 5.3)
- CVE-2026-15023 — Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action (CVSS 6.5)
- CVE-2026-18366 — Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator (CVSS 9.8)
- CVE-2026-18057 — Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection (CVSS 8.1)
- CVE-2026-66457 — WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-18050 — Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads (CVSS 7.5)
- CVE-2026-12987 — Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration (CVSS 7.5)
- CVE-2025-12976 — Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode (CVSS 6.4)
- CVE-2025-12408 — Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure (CVSS 5.3)
- CVE-2025-12407 — Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion (CVSS 4.3)
- CVE-2025-6976 — Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes (CVSS 5.4)
- CVE-2025-6975 — Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter (CVSS 6.1)
- CVE-2025-6970 — Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter (CVSS 7.5)
- CVE-2024-11260 — Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter (CVSS 7.5)
- CVE-2024-5889 — Events Manager <= 6.4.8 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2024-3492 — Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes (CVSS 5.4)
- CVE-2024-30515 — WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability (CVSS 8.8)