# EventPrime – Events Calendar, Bookings, Tickets & AI

> AI Events Calendar plugin for creating free or paid events. Supports Event Types, Bookings, Tickets, Venues, Performers, AI abilities, and a lot more.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:47 UTC.

## Facts (WordPress.org)

- Slug: `eventprime-event-calendar-management`
- Author: Metagauss
- Version: 4.3.9.0
- Active installs: 7,000+
- Last update: 2026-11-12 (2 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 4.8, PHP 7.2
- Tags: Event, event calendar, event manager, event organizer, events
- Page: https://wordpress.org/plugins/eventprime-event-calendar-management/

## Checks (against WordPress 7.1.4)

- OK: Updated 2 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-11-04 MEDIUM: Missing Authorization (before 4.3.6.1). CVE-2026-118523, https://www.wordfence.com/threat-intel/vulnerabilities/id/b9632e3b-1df4-46b2-92e8-8ed29ff2bf89?source=api-prod
- 2026-10-29 MEDIUM: Missing Authorization (up to 4.3.6.0). CVE-2026-42691, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b39ac65-611b-4bab-acc7-1c656c07a96a?source=api-prod
- 2026-07-09 HIGH: Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter (up to 4.3.4.2). CVE-2026-13441, https://www.wordfence.com/threat-intel/vulnerabilities/id/2abd400b-c633-4b38-ad3e-c9ce602ff07f?source=api-prod
- 2026-06-25 HIGH: Authenticated (Subscriber+) PHP Object Injection (up to 4.3.4.1). CVE-2026-56053, https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3fbecc-43c5-42da-85c9-8a732be71503?source=api-prod
- 2026-06-15 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 4.3.0.0). CVE-2026-39518, https://www.wordfence.com/threat-intel/vulnerabilities/id/77608ee4-1917-4b2c-8acf-5d6087c5ae7a?source=api-prod
- 2026-06-15 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 4.3.2.1). CVE-2026-42686, https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6cca8-cca9-4863-a879-20fdca23b334?source=api-prod
- 2026-06-15 HIGH: Unauthenticated PHP Object Injection (up to 4.3.2.1). CVE-2026-42687, https://www.wordfence.com/threat-intel/vulnerabilities/id/e5be210c-9116-4529-90e3-70625a0c40ce?source=api-prod
- 2026-06-02 MEDIUM: Missing Authorization (up to 4.3.2.0). CVE-2026-42669, https://www.wordfence.com/threat-intel/vulnerabilities/id/9ca6f612-a777-4962-848b-2a81bf35ae4c?source=api-prod
- 2026-03-18 MEDIUM: Missing Authorization (up to 4.2.8.3). CVE-2026-25312, https://www.wordfence.com/threat-intel/vulnerabilities/id/c603bd67-2e14-45ed-bbff-1bcbd3c18425?source=api-prod
- 2026-03-17 HIGH: Unauthenticated PHP Object Injection (up to 4.2.8.0). CVE-2026-24378, https://www.wordfence.com/threat-intel/vulnerabilities/id/ceebbad1-a239-485e-b021-5d4880f99f8a?source=api-prod
- 2026-03-10 MEDIUM: Missing Authorization (up to 4.2.6.0). CVE-2025-69358, https://www.wordfence.com/threat-intel/vulnerabilities/id/02461b79-d372-493f-9445-62b30b1db4cd?source=api-prod
- 2026-02-20 MEDIUM: Unauthenticated Information Exposure (up to 4.2.8.3). CVE-2026-25389, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b7c2644-5409-4a21-ba14-91475cb14cb2?source=api-prod
- 2026-02-17 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter (up to 4.2.8.4). CVE-2026-1655, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2a2769-1309-4aad-8411-4445efea2b66?source=api-prod
- 2026-02-16 MEDIUM: Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint (up to 4.2.8.4). CVE-2026-1657, https://www.wordfence.com/threat-intel/vulnerabilities/id/42aa82ff-0d37-4040-b8fc-84d29534a4b7?source=api-prod
- 2026-01-28 MEDIUM: Missing Authorization (up to 4.2.8.0). CVE-2026-24380, https://www.wordfence.com/threat-intel/vulnerabilities/id/797118e9-2b15-42ae-ae14-b9efa3dbbbba?source=api-prod
- 2026-01-12 MEDIUM: Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API (up to 4.2.7.0). CVE-2025-14507, https://www.wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=api-prod
- 2025-11-07 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Booking Note Creation (up to 4.2.0.0). CVE-2025-12498, https://www.wordfence.com/threat-intel/vulnerabilities/id/d32f7e98-8203-400e-bc26-4556ddba2510?source=api-prod
- 2025-11-06 MEDIUM: Authenticated (Subscriber+) Information Exposure (up to 4.2.4.1). CVE-2025-63007, https://www.wordfence.com/threat-intel/vulnerabilities/id/78e2001a-81e7-4fc6-a6cd-ee6afb4e4081?source=api-prod
- 2025-11-06 MEDIUM: Missing Authorization (up to 4.2.4.1). CVE-2025-63006, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b42be8d-5637-497c-bb11-759dba21e934?source=api-prod
- 2025-03-06 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Event Attendees Export (up to 4.0.7.3). CVE-2024-13526, https://www.wordfence.com/threat-intel/vulnerabilities/id/2be578d9-27c3-4a16-a634-1514ed97a1a2?source=api-prod
- 2024-12-16 HIGH: Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name (up to 4.0.7.3). CVE-2024-12024, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e51c8b5-cbb9-48aa-9c99-69f1b39fb0b4?source=api-prod
- 2024-10-29 MEDIUM: Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update (up to 3.4.9). CVE-2024-4665, https://www.wordfence.com/threat-intel/vulnerabilities/id/8c076c46-c87c-4fb2-8e8e-b342c016e09a?source=api-prod
- 2024-10-23 MEDIUM: Unauthenticated Stored Cross-Site Scripting via Transaction Log (up to 4.0.4.7). CVE-2024-9865, https://www.wordfence.com/threat-intel/vulnerabilities/id/18ded977-5297-4b6f-b9f3-0567f995d08a?source=api-prod
- 2024-10-23 MEDIUM: Unauthenticated Stored Cross-Site Scripting (up to 4.0.4.7). CVE-2024-9864, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2a66cb-ad13-428f-a25a-b2807450aa16?source=api-prod
- 2024-09-30 MEDIUM: Open Redirect (up to 4.0.4.5). CVE-2024-47648, https://www.wordfence.com/threat-intel/vulnerabilities/id/35c7c089-6517-419e-8ba3-e6c2692fe1ae?source=api-prod
- 2024-09-09 MEDIUM: Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure (up to 4.0.4.3). CVE-2024-8369, https://www.wordfence.com/threat-intel/vulnerabilities/id/97174ec0-a2b7-455e-9bf8-b6f51546beee?source=api-prod
- 2024-08-09 MEDIUM: Missing Authorization via calendar_event_create() (up to 4.0.3.2). CVE-2024-43223, https://www.wordfence.com/threat-intel/vulnerabilities/id/67b36ed7-d7f4-4944-b721-219d1990971a?source=api-prod
- 2024-04-05 MEDIUM: Missing Authorization to Booking Price Maniputlation (up to 3.3.4). CVE-2024-31275, https://www.wordfence.com/threat-intel/vulnerabilities/id/9516e64c-1959-4980-9a96-c6f5f1baa6f6?source=api-prod
- 2024-03-25 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 3.3.9). CVE-2024-29776, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d71289-e5a3-4145-817f-c2cac8405202?source=api-prod
- 2024-03-08 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending (up to 3.4.3). CVE-2024-1124, https://www.wordfence.com/threat-intel/vulnerabilities/id/346049ca-1bc5-4e02-9f38-d1f64338709d?source=api-prod
- 2024-03-08 MEDIUM: Missing Authorization to Arbitrary Post Overwrite (up to 3.4.2). CVE-2024-1123, https://www.wordfence.com/threat-intel/vulnerabilities/id/351926d4-a9be-4fbd-bdf2-8bbff41d97ef?source=api-prod
- 2024-03-08 MEDIUM: Unauthenticated Booking Payment Bypass (up to 3.4.2). CVE-2024-1321, https://www.wordfence.com/threat-intel/vulnerabilities/id/765d0933-8db2-471c-ad4e-e19d3b4ff015?source=api-prod
- 2024-03-08 MEDIUM: Unauthenticated Stored Cross-Site Scripting (up to 3.4.3). CVE-2024-1320, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e82e1c5-0ed4-4dee-9990-976591693eb5?source=api-prod
- 2024-03-08 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (up to 3.4.3). CVE-2024-1125, https://www.wordfence.com/threat-intel/vulnerabilities/id/b5278afb-9db3-4b1d-bb2f-e6595f0ac6dc?source=api-prod
- 2024-02-14 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Event Export (up to 3.4.1). CVE-2024-1127, https://www.wordfence.com/threat-intel/vulnerabilities/id/39da62be-e630-48cd-b732-80ed3d337638?source=api-prod
- 2024-02-14 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval (up to 3.4.2). CVE-2024-1126, https://www.wordfence.com/threat-intel/vulnerabilities/id/d266b6ee-24ec-4363-a986-5ccd4db5ae3c?source=api-prod
- 2024-02-02 MEDIUM: Improper Input Validation via save_event_booking (up to 3.3.9). CVE-2024-24832, https://www.wordfence.com/threat-intel/vulnerabilities/id/17cbcf67-f10d-41bc-acf7-98e5d99b50af?source=api-prod
- 2023-12-29 MEDIUM: Missing Authorization to Private Event Disclosure (up to 3.3.5). CVE-2023-6447, https://www.wordfence.com/threat-intel/vulnerabilities/id/5baea929-0c46-4a43-b2af-367c0b5037bb?source=api-prod
- 2023-11-21 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.3.2). WF-5124be64-6679-4dc5-8117-55c73ae91489, https://www.wordfence.com/threat-intel/vulnerabilities/id/5124be64-6679-4dc5-8117-55c73ae91489?source=api-prod
- 2023-10-31 MEDIUM: Cross-Site Request Forgery (before 3.2.0). CVE-2023-5519, https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19
- 2023-10-30 MEDIUM: Improper Server-Side Checks to Booking Payment Bypass (up to 3.3.2). CVE-2023-4252, https://www.wordfence.com/threat-intel/vulnerabilities/id/98ef80a3-4d57-45ae-87cf-d5768b26c27e?source=api-prod
- 2023-10-11 MEDIUM: Reflected Cross-Site Scripting via 'event_id' (up to 3.1.5). CVE-2023-45637, https://www.wordfence.com/threat-intel/vulnerabilities/id/399848fd-e9f6-40e4-bfeb-08f53eb511c6?source=api-prod
- 2023-10-09 MEDIUM: Reflected Cross-Site Scripting via keyword and ep_filter_date (before 3.2.0). CVE-2023-4250, https://www.wordfence.com/threat-intel/vulnerabilities/id/766e34a9-ed95-4049-ba48-0bf69134e4ba?source=api-prod
- 2023-10-09 MEDIUM: Cross-Site Request Forgery (before 3.2.0). CVE-2023-4251, https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ffdd43-b353-4296-bcb6-978751aae1b6?source=api-prod
- 2023-10-09 MEDIUM: Reflected HTML Content Injection (before 3.2.0). CVE-2023-5238, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed881d06-e652-45ac-8f56-c2db9e403485?source=api-prod
- 2023-05-22 MEDIUM: Reflected Cross-Site Scripting (up to 3.0.5). CVE-2023-35884, https://www.wordfence.com/threat-intel/vulnerabilities/id/0aad7f55-d1f0-45f9-ba8b-74170c32374f?source=api-prod
- 2023-05-22 MEDIUM: Sensitive Information Exposure (up to 2.8.6). CVE-2023-33321, https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdd0a4c-ce47-44bc-b9a5-a8f2af12da85?source=api-prod
- 2023-05-22 MEDIUM: Reflected Cross-Site Scripting (up to 2.8.6). CVE-2023-33326, https://www.wordfence.com/threat-intel/vulnerabilities/id/22479c6a-83ea-4c09-b192-4384ffbdcbf7?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=eventprime-event-calendar-management · HTML: https://todaywp.com/plugins/eventprime-event-calendar-management