vciy

CVEs we hold for Event

Records whose assigning authority named Event as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-9711EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search ParameterEventON (Pro) - WordPress Virtual Event Calendar Plugin
CVE-2026-91019Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential DisclosureUnknown Event Booking Manager for WooCommerce
CVE-2026-91008Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation PanelUnknown Event Booking Manager for WooCommerce
CVE-2026-84907Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST EndpointUnknown Eventin
CVE-2026-84906Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction ReplayUnknown Eventin
CVE-2026-84905Eventin < 4.1.24 - Contributor+ User Creation via Speaker CreationUnknown Eventin
CVE-2026-84901Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing AuthorizationUnknown Eventin
CVE-2026-84898Eventin < 4.1.21 - Contributor+ LFI via Event Layout MetaUnknown Eventin
CVE-2026-77702Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_tokenUnknown Eventin
CVE-2026-77694Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_tokenUnknown Eventin
CVE-2026-6268EventPress < 22.2 – Reflected Cross-Site ScriptingUnknown EventPress
CVE-2026-56053WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerabilityEventPrime
CVE-2026-42687WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerabilityEventPrime
CVE-2026-42686WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerabilityEventPrime
CVE-2026-42669WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerabilityEventPrime
CVE-2026-39518WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerabilityEventPrime
CVE-2026-18366Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to AdministratorUnknown Events Manager
CVE-2026-18057Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL InjectionUnknown Events Manager
CVE-2026-18050Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploadsUnknown Events Manager
CVE-2026-16067Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket PriceUnknown Event Booking Manager for WooCommerce (Pro)
CVE-2026-16064Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_eventUnknown Event Booking Manager for WooCommerce
CVE-2026-16063Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline ContentUnknown Event Booking Manager for WooCommerce
CVE-2026-16062Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentUnknown Event Booking Manager for WooCommerce
CVE-2026-14843Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDORUnknown Events Made Easy
CVE-2026-14842Events Made Easy < 3.1.2 - Unauthenticated Payment BypassUnknown Events Made Easy
CVE-2026-14823Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDORUnknown Event Tickets and Registration
CVE-2026-14822Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status ManipulationUnknown Event Tickets and Registration
CVE-2026-14819Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket MoveUnknown Event Tickets and Registration
CVE-2026-13178Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status ManipulationUnknown Eventin
CVE-2026-13177Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDORUnknown Eventin
CVE-2026-13176Eventin < 4.1.21 - Contributor+ Server-Side Request ForgeryUnknown Eventin
CVE-2026-13175Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDORUnknown Eventin
CVE-2026-13174Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDORUnknown Eventin
CVE-2026-13173Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker CreationUnknown Eventin
CVE-2026-13172Eventin < 4.1.22 - Unauthenticated Unpublished Content DisclosureUnknown Eventin
CVE-2026-13171Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List EndpointUnknown Eventin
CVE-2026-13170Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template SettingUnknown Eventin
CVE-2026-13169Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDORUnknown Eventin
CVE-2026-13168Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST APIUnknown Eventin
CVE-2026-12987Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationUnknown Events Manager
CVE-2026-10033EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability…EventON Action User
CVE-2026-10029Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API…eventkoi Event Koi Lite – Events Calendar, Event…
CVE-2025-68007WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerabilityEvent Espresso 4 Decaf
CVE-2025-58068Eventlet affected by HTTP request smuggling in unparsed trailerseventlet
CVE-2025-40639SQL injection in EventobotEventobot
CVE-2025-40638Reflected Cross-Site Scripting (XSS) in EventobotEventobot
CVE-2025-3527EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+)…EventON (Pro) - WordPress Virtual Event Calendar Plugin
CVE-2025-31838WordPress Eventbee RSVP Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEventbee RSVP Widget
CVE-2025-1762Event Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRFUnknown Event Tickets with Ticket Scanner
CVE-2025-11856Eventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEventbee Ticketing Widget
CVE-2024-8701Event Calendar <= 1.0.4 - Admin+ Stored XSSUnknown events-calendar
CVE-2024-8700Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar DeletionUnknown Event Calendar
CVE-2024-6910EventON < 2.2.17 - Admin+ Stored XSSUnknown EventON
CVE-2024-6883Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing…eventespresso Event Espresso – Event Registration &…
CVE-2024-6711Event Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSSUnknown Event Tickets with Ticket Scanner
CVE-2024-56251WordPress Event Espresso plugin <= 5.0.28.decaf - Cross Site Request Forgery (CSRF) vulnerabilityEvent Espresso 4 Decaf
CVE-2024-4752EventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitleUnknown EventON
CVE-2024-4665EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings updateUnknown EventPrime
CVE-2024-43223WordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerabilityEventPrime
CVE-2024-26133EventStoreDB Projections Subsystem has potential password leakEventStore
CVE-2024-1319Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists DisclosureUnknown Events Tickets Plus
CVE-2024-1316Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events AccessUnknown Events Tickets Plus
CVE-2024-1295The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events AccessUnknown The Events Calendar
CVE-2024-0238EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateUnknown EventON
CVE-2024-0237EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings UpdateUnknown EventON
CVE-2024-0236EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password DisclosureUnknown EventON
CVE-2024-0235EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address DisclosureUnknown EventON
CVE-2024-0233EventON (Free < 2.2.8, Premium < 4.5.5) - Reflected XSSUnknown EventON
CVE-2023-7200EventON < 4.4.1 - Reflected Cross-Site ScriptingUnknown EventON
CVE-2023-7170EventON-RSVP < 2.9.5 - Reflected XSSUnknown EventON-RSVP
CVE-2023-6447EventPrime < 3.3.6 - Unauthenticated Event AccessUnknown EventPrime
CVE-2023-6243EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_emailEventON (Pro) - WordPress Virtual Event Calendar Plugin
CVE-2023-6046EventON < 2.2 - Admin+ Stored HTML InjectionUnknown EventON
CVE-2023-6005EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site ScriptingUnknown EventON
CVE-2023-5519EventPrime < 3.2.0 - Booking Creation via CSRFUnknown EventPrime
CVE-2023-5238EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameterUnknown EventPrime
CVE-2023-45637WordPress EventPrime Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)EventPrime – Events Calendar, Bookings and Tickets
CVE-2023-4388EventON < 2.2 - Admin+ Stored XSSUnknown EventON
CVE-2023-4252EventPrime <= 3.2.9 - Booking Pricing BypassUnknown EventPrime
CVE-2023-4251EventPrime < 3.2.0 - Booking Creation via CSRFUnknown EventPrime
CVE-2023-4250EventPrime < 3.2.0 - Reflected XSSUnknown EventPrime
CVE-2023-35884WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)EventPrime
CVE-2023-33326WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)EventPrime
CVE-2023-3219EventON < 2.1.2 - Unauthenticated Post Access via IDORUnknown EventON
CVE-2023-28660no title heldn/a Events Made Easy WordPress Plugin
CVE-2023-2796EventON < 2.1.2 - Unauthenticated Event AccessUnknown EventON
CVE-2023-27437WordPress Event Espresso 4 Decaf plugin <= 4.10.44.decaf - Bypass vulnerabilityEvent Espresso 4 Decaf
CVE-2023-0144Event Manager and Tickets Selling Plugin for WooCommerce < 3.8.0 - Contributor+ Stored XSSUnknown Event Manager and Tickets Selling Plugin for…
CVE-2022-4110Eventify <= 2.1 - Admin+ Stored XSSUnknown Eventify™
CVE-2022-3720Event Monster < 1.2.1 - Admin+ SQLiUnknown Event Monster
CVE-2022-3336Event Monster < 1.2.0 - Visitors Deletion via CSRFUnknown Event Monster
CVE-2022-1905Events Made Easy < 2.2.81 - Unauthenticated SQLiUnknown Events Made Easy
CVE-2022-1650Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsourceeventsource/eventsource
CVE-2022-1324Event Timeline <= 1.1.5 - Admin+ Stored Cross-Site ScriptingUnknown Event Timeline – Vertical Timeline
CVE-2022-0478Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL InjectionUnknown Event Manager and Tickets Selling Plugin for…
CVE-2022-0418Event List < 0.8.8 - Admin+ Stored Cross-Site ScriptingUnknown Event List
CVE-2021-4404Event Espresso 4 Decaf <= 4.10.11 - Cross-Site Request Forgery Bypasseventespresso Event Espresso – Event Registration &…
CVE-2021-25030Events Made Easy < 2.2.36 - Subscriber+ SQL InjectionUnknown Events Made Easy
CVE-2021-25028Event Tickets < 5.2.2 - Open RedirectUnknown Event Tickets
CVE-2021-25025Event Calendar < 1.1.51 - Subscriber+ Event CreationUnknown EventCalendar
CVE-2021-25024Event Calendar < 1.1.51 - Reflected Cross-Site ScriptingUnknown EventCalendar
CVE-2021-24813Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site ScriptingUnknown Events Made Easy
CVE-2021-24480Event Geek <= 2.5.2 - Stored Cross-site Scripting (XSS)Unknown Event Geek
CVE-2021-24252Event Banner <= 1.3 - Arbitrary File Upload to RCEUnknown Event Banner
CVE-2021-21419Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in…eventlet
CVE-2020-35037Events Manager < 5.9.8 - Cross-Site Scripting (XSS)Unknown Events Manager
CVE-2020-35012Events Manager < 5.9.8 - Admin+ SQL InjectionUnknown Events Manager
CVE-2018-25076Events Extension events.php searchResults sql injectionn/a Events Extension
CVE-2017-1002026no title heldEvent Expresso Free

109 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.