Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · eventprime-event-calendar-management
EventPrime
45 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 9, 2026EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2026-13441 · affects up to 4.3.4.2 · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2026Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.CVE-2026-56053 · affects up to 4.3.4.1 · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.
Jun 15, 2026Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.CVE-2026-42687 · affects up to 4.3.2.1 · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.CVE-2026-42686 · affects up to 4.3.2.1 · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.
Jun 15, 2026Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.CVE-2026-39518 · affects up to 4.3.0.0 · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
Jun 2, 2026EventPrime: Missing AuthorizationCVE-2026-42669 · affects up to 4.3.2.0 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
Mar 25, 2026EventPrime: Deserialization of Untrusted DataCVE-2026-24378 · affects up to 4.2.8.0 · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
Mar 25, 2026EventPrime: Missing AuthorizationCVE-2025-69358 · affects up to 4.2.6.0 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.6.0.
Mar 19, 2026EventPrime: Missing AuthorizationCVE-2026-25312 · affects up to 4.2.8.3 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.3.
Feb 19, 2026EventPrime: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25389 · affects up to 4.2.8.3 · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.
Feb 18, 2026EventPrime: Unauthorized post modificationCVE-2026-1655 · affects up to 4.2.8.4 · reported by WordfenceMedium 4.3
The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4. This is due to the save_frontend_event_submission function accepting a user-controlled event_id parameter and updating the corresponding event post without enforcing ownership or capability checks. This makes it possible for authenticated (Customer+) attackers to modify posts created by administrators by manipulating the event_id parameter granted they can obtain a valid nonce.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2026EventPrime: Unauthorized image file uploadCVE-2026-1657 · affects up to 4.2.8.4 · reported by WordfenceMedium 5.3
The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implementing any authentication, authorization, or nonce verification despite a nonce being created. This makes it possible for unauthenticated attackers to upload image files to the WordPress uploads directory and create Media Library attachments via the ep_upload_file_media endpoint.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026EventPrime: Missing AuthorizationCVE-2026-24380 · affects up to 4.2.8.0 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.0.
Jan 13, 2026EventPrime - Events Calendar, Bookings and Tickets: Sensitive Information ExposureCVE-2025-14507 · affects up to 4.2.7.0 · reported by WordfenceMedium 5.3
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025EventPrime: Insertion of Sensitive Information Into Sent DataCVE-2025-63007 · affects up to 4.2.4.1 · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.4.1.
Dec 9, 2025EventPrime: Missing AuthorizationCVE-2025-63006 · affects up to 4.2.4.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.4.1.
Nov 8, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized booking note creationCVE-2025-12498 · affects up to 4.2.0.0 · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2025EventPrime: Does not properly validate permissionsCVE-2024-4665 · fixed in 3.5.0 · reported by WPScanMedium 6.4
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.
Mar 6, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-13526 · affects up to 4.0.7.3 · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.
Dec 17, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-12024 · affects up to 4.0.7.3 · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em_ticket_individual_data parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page. Note: this vulnerability requires the "Guest Submissions" setting to be enabled. It is disabled by default.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024EventPrime: Missing AuthorizationCVE-2024-43223 · affects up to 4.0.3.2 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.0.3.2.
Oct 24, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-9865 · affects up to 4.0.4.7 · reported by WordfenceMedium 6.1
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the transaction log for a booking.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-9864 · affects up to 4.0.4.7 · reported by WordfenceMedium 6.1
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when front-end users can submit new events with tickets.
Oct 10, 2024EventPrime: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47648 · affects up to 4.0.4.5 · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: from n/a through <= 4.0.4.5.
Sep 10, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access to Private or Password-protected eventsCVE-2024-8369 · affects up to 4.0.4.3 · reported by WordfenceMedium 5.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view private or password-protected events.
Jun 9, 2024EventPrime: Missing AuthorizationCVE-2024-31275 · affects up to 3.3.4 · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.
May 17, 2024EventPrime: Missing AuthorizationCVE-2023-33321 · affects up to 2.8.6 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.
Mar 27, 2024EventPrime: Cross Site Scripting (XSS)CVE-2024-29776 · affects up to 3.3.9 · reported by PatchstackMedium 5.9
Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Mar 23, 2024EventPrime: Missing AuthorizationCVE-2024-24832 · affects up to 3.3.9 · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Payment bypassCVE-2024-1321 · affects up to 3.4.2 · reported by WordfenceMedium 5.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free.
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-1127 · affects up to 3.4.1 · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the booking_export_all() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all event booking which can contain PII.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-1126 · affects up to 3.4.2 · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_attendees_email_by_event_id() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to to retrieve the attendees list for any event.
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-1320 · affects up to 3.4.3 · reported by WordfenceMedium 6.5
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_status' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized loss of dataCVE-2024-1125 · affects up to 3.4.3 · reported by WordfenceMedium 5.4
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized email sendingCVE-2024-1124 · affects up to 3.4.1 · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized modification of dataCVE-2024-1123 · affects up to 3.4.2 · reported by WordfenceMedium 6.5
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled.
Jan 22, 2024EventPrime: Lacks authentication and authorizationCVE-2023-6447 · fixed in 3.3.6 · reported by WPScanMedium 5.3
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.
Nov 27, 2023EventPrime: Specifies the price of a booking in the client requestCVE-2023-4252 · affects up to 3.2.9 · reported by WPScanMedium 5.3
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
Oct 31, 2023EventPrime: Does not have CSRF checksCVE-2023-5519 · fixed in 3.2.0 · reported by WPScanMedium 4.3
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
Oct 31, 2023EventPrime: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5238 · fixed in 3.2.0 · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
Oct 31, 2023EventPrime: Does not have CSRF checksCVE-2023-4251 · fixed in 3.2.0 · reported by WPScanMedium 4.3
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
Oct 31, 2023EventPrime: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-4250 · fixed in 3.2.0 · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Oct 25, 2023Unauth.CVE-2023-45637 · affects up to 3.1.5 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 versions.
Jun 20, 2023Unauth.CVE-2023-35884 · affects up to 3.0.5 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.
May 28, 2023Unauth.CVE-2023-33326 · fixed in 3.0.0 · reported by PatchstackHigh 7.1
Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.