Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · events-made-easy
events-made-easy
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 16, 2026Events Made Easy: Stored Cross-Site ScriptingCVE-2026-107649 · affects up to 3.2.22 · reported by WordfenceMedium 5.4
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.CVE-2026-28162 · affects up to 3.2.5 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
Aug 20, 2026Events Made Easy: Local File InclusionCVE-2026-75963 · affects up to 3.2.5 · reported by WordfenceHigh 7.5
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 6, 2026Events Made Easy: Does not bind the payment authorization token to the payment record being chargedCVE-2026-14842 · fixed in 3.1.2 · reported by WPScanMedium 5.3
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
Jul 31, 2026Events Made Easy: Does not verify that the requester is authorized to modify the targeted recordCVE-2026-14843 · fixed in 3.1.4 · reported by WPScanMedium 5.3
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
Jul 27, 2026Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.CVE-2026-59557 · affects up to 3.1.3 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
Jan 19, 2023Events Made Easy: Authorization bypassCVE-2023-0404 · affects up to 2.3.16 · reported by WordfenceMedium 5.4
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
Jun 20, 2022Events Made Easy: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1905 · fixed in 2.2.81 · reported by WPScanCritical 9.8
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Jan 3, 2022Events Made Easy: Does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX actionCVE-2021-25030 · fixed in 2.2.36 · reported by WPScanHigh 8.8
The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks
Nov 1, 2021Events Made Easy: Does not sanitise and escape Custom Field NamesCVE-2021-24813 · fixed in 2.2.24 · reported by WPScanMedium 4.8
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.