# Events Manager – Calendar, Bookings, Tickets, Appointments and more!

> Events calendar and booking system: bookings, reservations, appointments, scheduling, event registration, tickets and recurring events.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:31 UTC.

## Facts (WordPress.org)

- Slug: `events-manager`
- Author: Marcus (aka @msykes)
- Version: 7.4.14
- Active installs: 60,000+
- Last update: 2026-11-12 (2 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.1, PHP 7.4
- Tags: appointments, bookings, calendar, events, tickets
- Page: https://wordpress.org/plugins/events-manager/

## Checks (against WordPress 7.1.4)

- OK: Updated 2 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-10-24 MEDIUM: Reflected Cross-Site Scripting (up to 7.4.8). CVE-2026-114694, https://www.wordfence.com/threat-intel/vulnerabilities/id/234abb7b-c810-489b-98d5-194340afdfb8?source=api-prod
- 2026-10-12 MEDIUM: Unauthenticated Race Condition (up to 7.4.8). CVE-2026-42689, https://www.wordfence.com/threat-intel/vulnerabilities/id/e1eafbdf-450a-4cc9-b917-3f3802e089f1?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 7.4.6). CVE-2026-42633, https://www.wordfence.com/threat-intel/vulnerabilities/id/5856ff11-7c9a-4f0f-99f1-b839c2f847e1?source=api-prod
- 2026-10-05 MEDIUM: Unauthenticated Information Exposure (up to 7.4.5). CVE-2026-105068, https://www.wordfence.com/threat-intel/vulnerabilities/id/425d9583-71cc-4d05-beeb-104030a2b5f5?source=api-prod
- 2026-09-24 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference (up to 7.4.4). CVE-2026-93661, https://www.wordfence.com/threat-intel/vulnerabilities/id/5d782c54-f4f4-4ffe-a261-7cc6a900f9ea?source=api-prod
- 2026-09-24 MEDIUM: Authenticated (Subscriber+) Information Exposure (7.4.1 to 7.4.4). CVE-2026-93662, https://www.wordfence.com/threat-intel/vulnerabilities/id/14dcd7a0-4fa7-4b07-b2d1-5d6c605c7fc5?source=api-prod
- 2026-09-05 MEDIUM: Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes (up to 7.3.3). CVE-2025-14945, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1985eb5-bfb5-4220-a4f8-fcfa84beae6a?source=api-prod
- 2026-08-25 MEDIUM: Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action (up to 7.4.0). CVE-2026-15023, https://www.wordfence.com/threat-intel/vulnerabilities/id/fe1e8c38-345a-4529-81ba-188a8dc58503?source=api-prod
- 2026-08-25 MEDIUM: Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters (up to 7.4.0). CVE-2026-10627, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e52475e-2a04-4973-b419-fb477fe872e5?source=api-prod
- 2026-08-25 MEDIUM: Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys (up to 7.3.7.4). CVE-2026-14280, https://www.wordfence.com/threat-intel/vulnerabilities/id/aead557d-aec9-4218-9e5f-01b58432486f?source=api-prod
- 2026-08-25 MEDIUM: Reflected Cross-Site Scripting via 'header_format' Parameter (up to 7.4.0.1). CVE-2026-17089, https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d1a9e-7564-41b0-af03-c272ffbbbb97?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 7.4.0). CVE-2026-18057, https://www.wordfence.com/threat-intel/vulnerabilities/id/647b0d58-1397-47ad-b001-6d5085fb4c4f?source=api-prod
- 2026-08-12 HIGH: Unauthenticated Privilege Escalation (up to 7.4.0). CVE-2026-18366, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2ed2b1-487b-4178-9bfa-4dfd2777b625?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 7.4.2). CVE-2026-66457, https://www.wordfence.com/threat-intel/vulnerabilities/id/762fe5b1-6290-432f-904f-08dcf966e304?source=api-prod
- 2026-08-06 MEDIUM: Unauthenticated Pending Upload Disclosure (up to 7.3). CVE-2026-18050, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3ca502-177e-4337-93e3-347c773d2761?source=api-prod
- 2026-07-22 HIGH: Unauthenticated SQL Injection (up to 7.3.6). CVE-2026-12987, https://www.wordfence.com/threat-intel/vulnerabilities/id/1462f52b-98f0-40de-8f95-717992c7cbc6?source=api-prod
- 2026-07-13 HIGH: Unauthenticated PHP Object Injection (up to 7.3.6). CVE-2026-57713, https://www.wordfence.com/threat-intel/vulnerabilities/id/855f3030-3d0b-4886-8d40-a2245a787ab4?source=api-prod
- 2025-12-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode (up to 7.2.2.1). CVE-2025-12976, https://www.wordfence.com/threat-intel/vulnerabilities/id/17e853b2-c7ab-478c-9c89-d8e3a42d1a42?source=api-prod
- 2025-12-11 MEDIUM: Unauthenticated Information Exposure (up to 7.2.2.2). CVE-2025-12408, https://www.wordfence.com/threat-intel/vulnerabilities/id/8470b7be-6fae-4941-b523-93e230366522?source=api-prod
- 2025-12-11 MEDIUM: Cross-Site Request Forgery to Location Deletion (up to 7.2.2.2). CVE-2025-12407, https://www.wordfence.com/threat-intel/vulnerabilities/id/a99d0220-38af-40fe-8b9f-af173fc41248?source=api-prod
- 2025-07-09 HIGH: Unauthenticated SQL Injection via `orderby` Parameter (up to 6.6.4.4, 7.0.1 to 7.0.3). CVE-2025-6970, https://www.wordfence.com/threat-intel/vulnerabilities/id/7320c06e-a7a7-4ed0-93cd-e85d74bae73f?source=api-prod
- 2025-07-09 MEDIUM: Reflected Cross-Site Scripting via `calendar_header` Parameter (up to 6.6.4.4, 7.0.1 to 7.0.3). CVE-2025-6975, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3e59b-837b-4058-b7bc-a22cff22afb4?source=api-prod
- 2025-07-09 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes (up to 6.6.4.4, 7.0.1 to 7.0.3). CVE-2025-6976, https://www.wordfence.com/threat-intel/vulnerabilities/id/da97a395-64b8-4efd-b189-f917674b1c18?source=api-prod
- 2025-02-26 MEDIUM: Missing Authorization (up to 6.6.4.1). CVE-2025-1249, https://www.wordfence.com/threat-intel/vulnerabilities/id/1508ae48-099c-44a2-a1c8-000a5e5acbef?source=api-prod
- 2025-02-20 HIGH: Unauthenticated SQL Injection via Event Status Parameter (up to 6.6.3). CVE-2024-11260, https://www.wordfence.com/threat-intel/vulnerabilities/id/925402a5-e203-4976-b0a9-88c974b540b9?source=api-prod
- 2024-06-28 MEDIUM: Reflected Cross-Site Scripting (up to 6.4.8). CVE-2024-5889, https://www.wordfence.com/threat-intel/vulnerabilities/id/73cbb65e-b4e3-4374-9916-9a3d1be5a014?source=api-prod
- 2024-06-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes (up to 6.4.7.3). CVE-2024-3492, https://www.wordfence.com/threat-intel/vulnerabilities/id/a767f65e-bc7d-4576-af78-b77bd23dc089?source=api-prod
- 2024-03-28 MEDIUM: Missing Authorization (up to 6.4.6.4). CVE-2024-30515, https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb0aa16-a269-4297-861f-6bad88066c68?source=api-prod
- 2024-03-28 MEDIUM: Cross-Site Request Forgery (up to 6.4.7.1). CVE-2024-30421, https://www.wordfence.com/threat-intel/vulnerabilities/id/86351e2c-8c5a-4d71-bd73-d5ae1f03038f?source=api-prod
- 2024-03-27 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 6.4.7.1). CVE-2024-2111, https://www.wordfence.com/threat-intel/vulnerabilities/id/95ded4bf-9964-4bb3-b6e5-5ad37360f87d?source=api-prod
- 2024-03-27 MEDIUM: Cross-Site Request Forgery (up to 6.4.7.1). CVE-2024-2110, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0538999-0a09-4d24-a530-a32fb5b4e5e6?source=api-prod
- 2024-02-28 MEDIUM: Authenticated(Administator+) Stored Cross-Site Scripting via settings (up to 6.4.6.4). CVE-2024-0614, https://www.wordfence.com/threat-intel/vulnerabilities/id/6288fddf-926f-4506-94de-696e0a23766d?source=api-prod
- 2023-11-23 MEDIUM: Reflected Cross-Site Scripting (up to 6.4.5). CVE-2023-48326, https://www.wordfence.com/threat-intel/vulnerabilities/id/9053cf91-0af1-44f8-9fdf-7ecbd457545b?source=api-prod
- 2020-06-07 HIGH: Admin+ SQL Injection (up to 5.9.7.3). CVE-2020-35012, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ccb39b-faf1-428b-bfa7-c30d402bd34d?source=api-prod
- 2020-06-07 MEDIUM: Cross-Site Scripting (up to 5.9.7.3). CVE-2020-35037, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2244c29-9d79-47d5-b077-bf04a9199cdc?source=api-prod
- 2020-02-06 HIGH: Unauthenticated CSV Injection (before 5.9.7.2). WF-74b81d31-8ee6-47cf-a5e8-3cf0900ebea0-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/74b81d31-8ee6-47cf-a5e8-3cf0900ebea0?source=api-prod
- 2020-02-05 MEDIUM: CSV Injection (up to 5.9.7.1). WF-156e64f2-87a4-40a0-bac8-3dc1f702b0a1, https://www.wordfence.com/threat-intel/vulnerabilities/id/156e64f2-87a4-40a0-bac8-3dc1f702b0a1?source=api-prod
- 2019-10-16 MEDIUM: Authenticated Stored Cross-Site Scripting (up to 5.9.5). CVE-2019-16523, https://www.wordfence.com/threat-intel/vulnerabilities/id/249acca6-49b4-4ddf-af75-31f68921fc19?source=api-prod
- 2018-07-18 MEDIUM: Cross-Site Scripting (up to 5.9.4). CVE-2018-13137, https://www.wordfence.com/threat-intel/vulnerabilities/id/94d2eaed-048b-40b6-9880-fa32fbb66f92?source=api-prod
- 2018-04-27 MEDIUM: Stored Cross-Site Scripting (before 5.9). CVE-2018-0576, https://www.wordfence.com/threat-intel/vulnerabilities/id/738a9651-974e-4861-be7a-2d9b191d582b?source=api-prod
- 2018-03-26 MEDIUM: Cross-Site Scripting (before 5.8.1.2). CVE-2018-9020, https://www.wordfence.com/threat-intel/vulnerabilities/id/73241750-cd21-4eee-9d43-8c5e26f9b9cf?source=api-prod
- 2015-08-10 MEDIUM: Cross-Site Scripting (before 5.6). CVE-2015-9297, https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4e08e0-25b7-47b2-9ec2-de93afc437a6?source=api-prod
- 2015-08-10 CRITICAL: Code Injection (before 5.6). CVE-2015-9298, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb66378c-4e64-4f05-a466-72a3c2d0b330?source=api-prod
- 2015-06-04 MEDIUM: Cross-Site Scripting (before 5.5.7.1). CVE-2015-9299, https://www.wordfence.com/threat-intel/vulnerabilities/id/df4ad83f-280e-46fa-ad47-3822fa67b10d?source=api-prod
- 2015-05-23 MEDIUM: Cross-Site Scripting (before 5.5.7). CVE-2015-9300, https://www.wordfence.com/threat-intel/vulnerabilities/id/a43ffb6e-8044-4496-9496-11fa8e52a044?source=api-prod
- 2014-08-01 MEDIUM: Cross-Site Scripting (before 5.3.5). WF-0c4d2829-9f99-4a2d-9bde-476fae2c99a4-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/0c4d2829-9f99-4a2d-9bde-476fae2c99a4?source=api-prod
- 2014-08-01 MEDIUM: Cross-Site Scripting (before 5.3.9). CVE-2013-7479, https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb95e28-449b-4ed7-9c44-ade171e0ecee?source=api-prod
- 2014-08-01 MEDIUM: Multiple Cross-Site Scripting (up to 5.5.1). CVE-2013-7477, https://www.wordfence.com/threat-intel/vulnerabilities/id/734b6ae0-b2f6-4bad-a6d3-bef48fd8cdd0?source=api-prod
- 2013-08-14 MEDIUM: Cross-Site Scripting (before 5.5). CVE-2013-7478, https://www.wordfence.com/threat-intel/vulnerabilities/id/e247c919-6210-4769-9022-d7f7a0178f14?source=api-prod
- 2013-02-27 MEDIUM: Multiple Cross-Site Scripting (up to 5.3.6). CVE-2013-7480, https://www.wordfence.com/threat-intel/vulnerabilities/id/efd25f74-3c4a-4f5a-8c81-f1d42ca2a541?source=api-prod
- 2012-05-22 MEDIUM: Cross-Site Scripting (before 5.1.7). CVE-2012-6716, https://www.wordfence.com/threat-intel/vulnerabilities/id/207f7684-aeee-4267-ba29-ca9aacc0a690?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=events-manager · HTML: https://todaywp.com/plugins/events-manager