Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
342 results · page 2 of 7
Aug 18, 2026Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.CVE-2026-73339 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 13, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) is assigned to the appointment being accessedCVE-2026-14213 · WordPress plugins & themes · reported by WPScanLow 3.7
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.6
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.6 or newer.
Aug 12, 2026Events Manager: Does not properly scope its capability mappingCVE-2026-18366 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.
- Product
- Events Manager
- Fixed in
- 7.4.1
- What to do
- Update Events Manager to 7.4.1 or newer.
Aug 12, 2026Events Manager: Does not sanitise and escape a user-controlled value before using it in a SQL statementCVE-2026-18057 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
- Product
- Events Manager
- Fixed in
- 7.4.1
- What to do
- Update Events Manager to 7.4.1 or newer.
Aug 10, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) is related to the customer whose record is being accessedCVE-2026-14211 · WordPress plugins & themes · reported by WPScanLow 3.8
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.7
- What to do
- Update Booking for Appointments and Events Calendar to 9.7 or newer.
Aug 7, 2026WP Events Manager: Does not verify that an incoming payment notification originates from the site's configured merchant accountCVE-2026-15148 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
- Product
- WP Events Manager
- Fixed in
- 2.2.5
- What to do
- Update WP Events Manager to 2.2.5 or newer.
Aug 7, 2026WP Events Manager: Does not validate the requested quantityCVE-2026-14205 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
- Product
- WP Events Manager
- Fixed in
- 2.2.5
- What to do
- Update WP Events Manager to 2.2.5 or newer.
Aug 6, 2026Events Made Easy: Does not bind the payment authorization token to the payment record being chargedCVE-2026-14842 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
- Product
- Events Made Easy
- Fixed in
- 3.1.2
- What to do
- Update Events Made Easy to 3.1.2 or newer.
Aug 6, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
- Product
- Events Manager
- Affected
- up to 7.4.2
- What to do
- Affects up to 7.4.2. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Events Manager: Does not perform any authorization check on a REST route that serves temporarily stored file uploadsCVE-2026-18050 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.
- Product
- Events Manager
- Fixed in
- 7.4
- What to do
- Update Events Manager to 7.4 or newer.
Aug 4, 2026Simple Google Calendar Outlook Events Widget: Does not validate a user-supplied URL before performing a server-side requestCVE-2026-16536 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
- Product
- Simple Google Calendar Outlook Events Widget
- Fixed in
- 3.1.0
- What to do
- Update Simple Google Calendar Outlook Events Widget to 3.1.0 or newer.
Aug 1, 2026Booking for Appointments and Events Calendar: Does not restrictCVE-2026-14214 · WordPress plugins & themes · reported by WPScanLow 2.7
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.4
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.4 or newer.
Jul 31, 2026Events Made Easy: Does not verify that the requester is authorized to modify the targeted recordCVE-2026-14843 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
- Product
- Events Made Easy
- Fixed in
- 3.1.4
- What to do
- Update Events Made Easy to 3.1.4 or newer.
Jul 27, 2026Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.CVE-2026-59557 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Events Calendar: Does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status valueCVE-2026-13390 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
- Product
- Events Calendar
- Fixed in
- 6.16.5.1
- What to do
- Update Events Calendar to 6.16.5.1 or newer.
Jul 23, 2026Tickera – Sell Tickets & Manage Events: Generic SQL InjectionCVE-2026-15761 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied.
- Product
- Tickera – Sell Tickets & Manage Events
- Affected
- up to 3.6.0.1
- What to do
- Affects up to 3.6.0.1. Update Tickera – Sell Tickets & Manage Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Tickera – Sell Tickets & Manage Events: Generic SQL InjectionCVE-2026-15448 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Tickera – Sell Tickets & Manage Events
- Affected
- up to 3.6.0.1
- What to do
- Affects up to 3.6.0.1. Update Tickera – Sell Tickets & Manage Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Registrations For The Events Calendar: SQL InjectionCVE-2026-13119 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST['standard'] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Registrations For The Events Calendar
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Registrations For The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2026Events Manager: Does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is storedCVE-2026-12987 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.
- Product
- Events Manager
- Fixed in
- 7.3.7
- What to do
- Update Events Manager to 7.3.7 or newer.
Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
- Product
- Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite
- Fixed in
- 7.34.0
- What to do
- Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.
Jul 16, 2026Booking for Appointments and Events Calendar – Amelia: SQL InjectionCVE-2026-14782 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with wpamelia-manager role, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 16, 2026Tickera – Sell Tickets & Manage Events: Stored Cross-Site ScriptingCVE-2026-13755 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute in all versions up to, and including, 3.6.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution of the injected script is limited to victims who have the referenced ticket ID present in their cart cookie, meaning the payload only fires for users who have previously added that ticket to their cart.
- Product
- Tickera – Sell Tickets & Manage Events
- Affected
- up to 3.6.0.0
- What to do
- Affects up to 3.6.0.0. Update Tickera – Sell Tickets & Manage Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026Tickera – Sell Tickets & Manage Events: Generic SQL InjectionCVE-2026-13754 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Tickera – Sell Tickets & Manage Events
- Affected
- up to 3.6.0.0
- What to do
- Affects up to 3.6.0.0. Update Tickera – Sell Tickets & Manage Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026Events Manager: Deserialization of Untrusted DataCVE-2026-57713 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.
- Product
- Events Manager
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2026EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2026-13441 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.3.4.2
- What to do
- Affects up to 4.3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 8, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Improper Input ValidationCVE-2026-5356 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.4.0
- What to do
- Affects up to 5.4.0. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 3, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization bypassCVE-2026-11398 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including those linked to administrator accounts, by submitting the booking form with a known customer's email address. Exploitation requires the plugin to be configured with guest bookings enabled (is_customer_auth_disabled() returning true), which is necessary for the vulnerable unauthenticated code path in process_step_customer() to be reached.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.6.1
- What to do
- Affects up to 5.6.1. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2026-12657 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'service_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to create approved bookings against services explicitly restricted to admins and agents, consuming restricted appointment capacity and triggering unauthorized bookings for admin/agent-only services. The bypass works via both the params[booking][service_id] parameter in steps__load_step and the presets[selected_service] parameter in steps__start, both of which are publicly accessible without authentication.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 1, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-13228 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController, which allows an authenticated Agent to supply an arbitrary order[customer_id] and overwrite any LatePoint customer's email field (including one linked to a WordPress Administrator's account) through the public-scope customer set_data() call, combined with a missing role verification in OsAuthHelper::authorize_customer() which logs in the linked WordPress user without checking its role. This makes it possible for authenticated attackers, with custom (Agent)-level access and above, to elevate their privileges to Administrator.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 18, 2026Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets: Sensitive Information ExposureCVE-2026-10029 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.13.1 via the get_events. This makes it possible for unauthenticated attackers to extract sensitive data including virtual meeting URLs, physical location data, latitude/longitude coordinates, Google Maps links, and RSVP configuration belonging to draft, pending, and private events that are otherwise inaccessible via public URLs.
- Product
- Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets
- Affected
- up to 1.3.13.1
- What to do
- Affects up to 1.3.13.1. Update Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.CVE-2025-69135 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-8176 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49772 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
- Product
- The Events Calendar
- Affected
- up to 6.16.2
- What to do
- Affects up to 6.16.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.CVE-2026-39532 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
- Affected
- up to 2.3.25
- What to do
- Affects up to 2.3.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2026Events Calendar for GeoDirectory: Privilege EscalationCVE-2026-11616 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.
- Product
- Events Calendar for GeoDirectory
- Affected
- up to 2.3.28
- What to do
- Affects up to 2.3.28. Update Events Calendar for GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026WPForms: Does not verify the authenticity of incoming PayPal webhook events before processing themCVE-2026-4986 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
- Product
- WPForms
- Fixed in
- 1.10.0.5
- What to do
- Update WPForms to 1.10.0.5 or newer.
Jun 5, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Cross-Site Request ForgeryCVE-2026-9719 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the change_status function. This makes it possible for unauthenticated attackers to change the status of arbitrary invoices — including marking unpaid invoices as paid — without administrator consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2026Event Monster – Event Management, Events Calendar, Tickets: Insufficient Verification of Data AuthenticityCVE-2026-8608 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusting client-supplied payment data — including transaction ID, amount, and payment status — without performing any server-side verification against the PayPal API or any other payment gateway, and without nonce or capability checks. This makes it possible for unauthenticated attackers to forge payment records, mark bookings as Completed, and obtain confirmation emails containing valid QR code tickets without making any actual payment.
- Product
- Event Monster – Event Management, Events Calendar, Tickets
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Event Monster – Event Management, Events Calendar, Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 27, 2026Events In City: Stored Cross-Site ScriptingCVE-2026-8898 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (such as 'organizer_id', 'width', 'height', 'transparency', 'header', 'border', and 'layout') in the org_event_scode() function. The attribute values are concatenated directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Events In City
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Events In City to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 6, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2026-7332 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_form_page_url' parameter in all versions up to, and including, 5.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious activity log entry is written to the database even when Stripe is not configured, because the latepoint_order_intent_created action hook fires before the Stripe Connect account ID is validated, meaning a fully functional Stripe integration is not required for exploitation.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 4, 2026The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that CVE-2026-41471 · WordPress plugins & themes · reported by VulnCheckHigh 8.2
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.
- Product
- Easy PayPal Events & Tickets
- What to do
- Update Easy PayPal Events & Tickets to the newest version.
Full record and what to do →NVD recordgist.github.comwordpress.org
May 4, 2026the QR code scanning functionality that: Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypassCVE-2026-32834 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.
- Product
- the QR code scanning functionality that
- What to do
- Update the QR code scanning functionality that to the newest version.
Full record and what to do →NVD recordgist.github.comwordpress.org
May 2, 2026Booking for Appointments and Events Calendar – Amelia: Improper AuthorizationCVE-2026-6449 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unauthenticated attackers to approve any booking that is in 'waiting' status by sending a crafted request to the publicly-accessible admin-ajax endpoint.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 27, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege EscalationCVE-2026-6741 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and subsequently reset the administrator's password via the normal customer password-reset flow, resulting in full site takeover.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.4.1
- What to do
- Affects up to 5.4.1. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 16, 2026My Calendar is a WordPress plugin for managing calendar events.CVE-2026-40308 · WordPress plugins & themes · reported by GitHubHigh 8.8
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.
- Fixed in
- 3.7.7
- What to do
- Update the plugin to 3.7.7 or newer.
Apr 14, 2026Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered): Unauthorized access of dataCVE-2026-4109 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the get_item_permissions_check() function in all versions up to, and including, 4.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order data including customer PII (name, email, phone) by iterating order IDs.
- Product
- Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered)
- Affected
- up to 4.1.8
- What to do
- Affects up to 4.1.8. Update Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 8, 2026Display Eventbrite Events: Missing AuthorizationCVE-2026-39535 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.
- Product
- Display Eventbrite Events
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update Display Eventbrite Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2026-4785 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latepoint_resources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Booking for Appointments and Events Calendar – Amelia: Insecure Direct Object ReferenceCVE-2026-5465 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the `externalId` field when a Provider (Employee) user updates their own profile. The `externalId` maps directly to a WordPress user ID and is passed to `wp_set_password()` and `wp_update_user()` without authorization checks. This makes it possible for authenticated attackers, with Provider-level (Employee) access and above, to take over any WordPress account — including Administrator — by injecting an arbitrary `externalId` value when updating their own provider profile.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2026Booking for Appointments and Events Calendar - Amelia: SQL InjectionCVE-2026-4668 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied `sort` parameter and lack of sufficient preparation on the existing SQL query in `PaymentRepository.php`, where the sort field is interpolated directly into an ORDER BY clause without sanitization or whitelist validation. PDO prepared statements do not protect ORDER BY column names. GET requests also skip Amelia's nonce validation entirely. This makes it possible for authenticated attackers, with Manager-level (`wpamelia-manager`) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection.
- Product
- Booking for Appointments and Events Calendar - Amelia
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Booking for Appointments and Events Calendar - Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.