What’s Vulnerable › Products
wpeventmanager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce vulnerabilities
13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.
Latest wpeventmanager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce vulnerabilities
- CVE-2025-2800 — WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name' (CVSS 6.1)
- CVE-2025-2799 — WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2025-49980 — WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability (CVSS 4.3)
- CVE-2025-48125 — WordPress WP Event Manager plugin <= 3.1.51 - Local File Inclusion Vulnerability (CVSS 8.1)
- CVE-2025-32225 — WordPress WP Event Manager plugin <= 3.2.0 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2024-2691 — WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode (CVSS 5.4)
- CVE-2024-0976 — WP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via plugin (CVSS 6.1)
- CVE-2023-52118 — WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2023-49181 — WordPress WP Event Manager Plugin <= 3.1.40 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2023-47697 — WordPress WP Event Manager Plugin <= 3.1.39 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2023-4423 — WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2022-1474 — WP Event Manager < 3.1.28 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2021-24810 — WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)