WordPress security by component

EventPrime

Plugin description

EventPrime creates and manages events, calendars, venues, bookings, tickets, and event registration within WordPress.

EventPrime (eventprime-event-calendar-management) is a WordPress plugin with 30 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 9.8.

Plugin slug: eventprime-event-calendar-management

Latest vulnerability

CVE-2026-42691: EventPrime: Authorization bypass

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 4.3.6.0.

PublishedOct 29, 2026

Known safe version4.3.6.1

Published vulnerabilities for eventprime-event-calendar-management
		Safe version
Oct 29, 2026	CVE-2026-42691 EventPrime: Authorization bypass Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 4.3.6.0.	4.3.6.1	CVE5.4
Jul 09, 2026	CVE-2026-13441 EventPrime – Events Calendar, Bookings and Tickets: Cross-site scripting EventPrime – Events Calendar, Bookings and Tickets is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.3.4.2.	See mitigation notes	CVE7.2
Jun 25, 2026	CVE-2026-56053 EventPrime: Code execution EventPrime is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 4.3.4.1.	4.3.4.2	CVE8.8
Jun 15, 2026	CVE-2026-42687 EventPrime: Code execution EventPrime is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 4.3.2.1.	4.3.2.2	CVE8.1
Jun 15, 2026	CVE-2026-42686 EventPrime: Cross-site scripting EventPrime is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.3.2.1.	4.3.2.2	CVE7.1
Jun 15, 2026	CVE-2026-39518 EventPrime: Broken access control EventPrime is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.3.0.0.	4.3.0.1	CVE7.1
Jun 02, 2026	CVE-2026-42669 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 4.3.2.0.	4.3.2.1	CVE7.5
Mar 25, 2026	CVE-2026-24378 EventPrime: Code execution EventPrime is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 4.2.8.0.	4.2.8.1	CVE9.8
Mar 25, 2026	CVE-2025-69358 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.2.6.0.	4.2.7.0	CVE7.5
Mar 19, 2026	CVE-2026-25312 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5
Feb 19, 2026	CVE-2026-25389 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Feb 18, 2026	CVE-2026-1655 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Feb 17, 2026	CVE-2026-1657 EventPrime: A security weakness EventPrime is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Jan 22, 2026	CVE-2026-24380 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Jan 13, 2026	CVE-2025-14507 EventPrime - Events Calendar, Bookings and Tickets: Sensitive information exposure EventPrime - Events Calendar, Bookings and Tickets is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE5.3
Dec 09, 2025	CVE-2025-63007 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Dec 09, 2025	CVE-2025-63006 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Nov 08, 2025	CVE-2025-12498 EventPrime – Events Calendar, Bookings and Tickets: A security weakness EventPrime – Events Calendar, Bookings and Tickets is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Mar 07, 2025	CVE-2024-13526 EventPrime – Events Calendar, Bookings and Tickets: A security weakness EventPrime – Events Calendar, Bookings and Tickets is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Dec 17, 2024	CVE-2024-12024 EventPrime – Events Calendar, Bookings and Tickets: Cross-site scripting EventPrime – Events Calendar, Bookings and Tickets is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2
Nov 01, 2024	CVE-2024-43223 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Sep 10, 2024	CVE-2024-8369 EventPrime – Events Calendar, Bookings and Tickets: A security weakness EventPrime – Events Calendar, Bookings and Tickets is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Jun 09, 2024	CVE-2024-31275 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.2
May 17, 2024	CVE-2023-33321 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Mar 27, 2024	CVE-2024-29776 EventPrime: Cross-site scripting EventPrime is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9
Mar 23, 2024	CVE-2024-24832 EventPrime: A security weakness EventPrime is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.2
Mar 13, 2024	CVE-2024-1127 EventPrime – Events Calendar, Bookings and Tickets: A security weakness EventPrime – Events Calendar, Bookings and Tickets is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Oct 25, 2023	CVE-2023-45637 Eventprime Event Calendar Management: Cross-site scripting Eventprime Event Calendar Management is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1
Jun 20, 2023	CVE-2023-35884 Eventprime Event Calendar Management: Cross-site scripting Eventprime Event Calendar Management is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1
May 28, 2023	CVE-2023-33326 Eventprime Event Calendar Management: Cross-site scripting Eventprime Event Calendar Management is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers