Read the docs

WP Event Manager

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

WP Event Manager records in CISA KEV

No WP Event Manager vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp Event Manager 10 records LOW Event Banner 1 record LOW User Profile Avatar 1 record MEDIUM

Records

10 records in Wp Event Manager · all components

TI-2025-02444 CVE-2025-2800 · GHSA-45jj-mm6q-53j7

WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'

Priority LOW 37

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and includi…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00298 Published 2025-07-16 No fix listed CWE-79
TI-2023-28557 CVE-2023-52118 · GHSA-v82p-3pq8-jrvq

WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-02-01 No fix listed CWE-79
TI-2022-01348 CVE-2022-1474 · GHSA-9hx4-3rxw-768x

WP Event Manager < 3.1.28 - Reflected Cross-Site Scripting

Priority LOW 29

The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00849 Published 2022-07-11 Fixed in 3.1.28 CWE-79
TI-2024-02506 CVE-2024-2691 · GHSA-pr5p-f64r-45r9

Cross-site scripting in WP Event Manager – Events Calendar, Registrations, Sell Tickets…

Priority LOW 28

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and includ…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00316 Published 2024-07-16 No fix listed CWE-79
TI-2024-00900 CVE-2024-0976 · GHSA-4pj4-wm5x-2j3f

WP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via plugin

Priority LOW 28

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the plugin parameter in all versions up to, and including, 3.1…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00592 Published 2024-03-13 No fix listed CWE-79
TI-2023-26840 CVE-2023-49181 · GHSA-xxx9-8q88-3qrf

WordPress WP Event Manager Plugin <= 3.1.40 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce allows Stored XSS.Th…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00382 Published 2023-12-15 No fix listed CWE-79
TI-2023-04083 CVE-2023-4423 · GHSA-3r9m-m4c8-57jx

Cross-site scripting in WP Event Manager – Events Calendar, Registrations, Sell Tickets…

Priority LOW 23

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.1.37.1 due to…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00596 Published 2023-09-27 No fix listed CWE-79
TI-2021-07092 CVE-2021-24810 · GHSA-p7xr-9xx7-g45r

WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_h…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-03-07 Fixed in 3.1.23 CWE-79
TI-2025-02443 CVE-2025-2799 · GHSA-vw29-qqxx-wc5m

WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting

Priority LOW 22

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00234 Published 2025-07-16 No fix listed CWE-79
Open these records in search →