WordPress security by component
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
Plugin description
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar is a WordPress component with 22 published CVE records in this archive. The latest tracked vulnerability was published Jul 29, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
mage-eventpressLatest vulnerability
CVE-2026-17166: Event Booking Manager lets contributors alter site-wide payment settings
Event Booking Manager for WooCommerce through 5.3.7 registers the authenticated AJAX action mep_save_payment_settings_modal without nonce verification. The ajax_save_payment_settings_modal() handler authorizes anyone with either manage_options or edit_posts, so a Contributor satisfies the check. It reads attacker-controlled POST values including mep_enable_wc_payment, mep_wc_add_to_cart_redirect, mep_wc_after_order_redirect, mep_wc_require_login, mep_confirmation_page_id, and mep_wc_confirm_ticket_status, then writes them to the site-wide payment_setting_sec option. A Contributor can therefore change payment enablement, checkout redirects, login requirements, confirmation-page selection, and which order statuses confirm tickets for every event booking. Version 5.3.8 verifies the mep_save_payment_settings nonce and requires manage_options.
| Safe version |
|
||
|---|---|---|---|
| Jul 29, 2026 |
CVE-2026-17166
Event Booking Manager lets contributors alter site-wide payment settings
Event Booking Manager for WooCommerce through 5.3.7 registers the authenticated AJAX action mep_save_payment_settings_modal without nonce verification. The ajax_save_payment_settings_modal() handler authorizes anyone with either manage_options or edit_posts, so a Contributor satisfies the check. It reads attacker-controlled POST values including mep_enable_wc_payment, mep_wc_add_to_cart_redirect, mep_wc_after_order_redirect, mep_wc_require_login, mep_confirmation_page_id, and mep_wc_confirm_ticket_status, then writes them to the site-wide payment_setting_sec option. A Contributor can therefore change payment enablement, checkout redirects, login requirements, confirmation-page selection, and which order statuses confirm tickets for every event booking. Version 5.3.8 verifies the mep_save_payment_settings nonce and requires manage_options.
|
5.3.8 |
CVE4.3
NVDPending
|
| Jun 15, 2026 |
CVE-2026-45441
WpEvently: A security weakness
WpEvently is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 5.3.3.
|
5.3.4 |
CVE7.5
NVDPending
|
| Jun 11, 2026 |
CVE-2024-32110
WpEvently: Cross-site request forgery
WpEvently is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is n/a through 4.1.2.
|
4.1.3 |
CVE4.3
NVDPending
|
| Mar 25, 2026 |
CVE-2026-25361
WpEvently: Cross-site scripting
WpEvently is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 5.1.4.
|
5.1.5 |
CVE7.1
NVDPending
|
| Mar 13, 2026 |
CVE-2026-32354
WpEvently: A security weakness
WpEvently is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Feb 19, 2026 |
CVE-2026-23549
WpEvently: Code execution
WpEvently is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Feb 03, 2026 |
CVE-2026-24954
WpEvently: Code execution
WpEvently is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Feb 03, 2026 |
CVE-2026-24942
WpEvently: Cross-site request forgery
WpEvently is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Nov 21, 2025 |
CVE-2025-66083
WpEvently: A security weakness
WpEvently is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Nov 21, 2025 |
CVE-2025-66082
WpEvently: A security weakness
WpEvently is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Aug 28, 2025 |
CVE-2025-54742
WpEvently: Code execution
WpEvently is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Aug 14, 2025 |
CVE-2025-54705
WpEvently: A security weakness
WpEvently is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jun 07, 2025 |
CVE-2025-5568
WpEvently: Cross-site scripting
WpEvently is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Apr 10, 2025 |
CVE-2025-32145
WpEvently: Code execution
WpEvently is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Mar 27, 2025 |
CVE-2025-30895
WpEvently: Filesystem traversal
WpEvently is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Mar 27, 2025 |
CVE-2025-30887
WpEvently: A security weakness
WpEvently is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Oct 24, 2024 |
CVE-2024-49703
WpEvently: Cross-site scripting
WpEvently is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Aug 13, 2024 |
CVE-2024-43138
Event Manager for WooCommerce: Filesystem traversal
Event Manager for WooCommerce is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE6.5
NVD8.8
|
| Feb 12, 2024 |
CVE-2024-24796
Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: Code execution
Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.2
NVD8.8
|
| Jul 18, 2023 |
CVE-2023-36383
Mage Eventpress: Cross-site scripting
Mage Eventpress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD5.4
|
| May 25, 2023 |
CVE-2022-47164
Mage Eventpress: Cross-site request forgery
Mage Eventpress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Mar 23, 2023 |
CVE-2023-28422
Mage Eventpress: Cross-site scripting
Mage Eventpress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|