VendorsPixeliteevents_managerall versions
Vulnerabilities

Pixelite Events Manager

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

26CVEs
CVE-2015-9298
The events-manager plugin before 5.6 for WordPress has code injection.
Published 2019-08-13 · Modified
9.8EPSS 0.021
CVE-2024-30515
WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability
Published 2024-06-09 · Modified
8.8EPSS 0.003
CVE-2025-6970
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
Published 2025-07-09 · Analyzed
7.5EPSS 0.653
CVE-2024-11260
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter
Published 2025-02-21 · Analyzed
7.5EPSS 0.006
CVE-2020-35012
Events Manager < 5.9.8 - Admin+ SQL Injection
Published 2021-12-01 · Modified
7.2EPSS 0.015
CVE-2023-48326
WordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)
Published 2023-11-30 · Modified
7.1EPSS 0.004
CVE-2024-2111
Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-03-28 · Modified
6.4EPSS 0.003
CVE-2024-3492
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes
Published 2024-06-12 · Modified
6.4EPSS 0.003
CVE-2025-6976
Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
Published 2025-07-09 · Analyzed
6.4EPSS 0.002
CVE-2015-9297
The events-manager plugin before 5.6 for WordPress has XSS.
Published 2019-08-13 · Modified
6.1EPSS 0.009
CVE-2015-9300
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Published 2019-08-13 · Modified
6.1EPSS 0.009
CVE-2015-9299
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
Published 2019-08-13 · Modified
6.1EPSS 0.009
CVE-2012-6716
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
Published 2019-08-22 · Modified
6.1EPSS 0.009
CVE-2013-7480
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
Published 2019-08-22 · Modified
6.1EPSS 0.009
CVE-2013-7479
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
Published 2019-08-22 · Modified
6.1EPSS 0.009
CVE-2013-7478
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
Published 2019-08-22 · Modified
6.1EPSS 0.009
CVE-2013-7477
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
Published 2019-08-22 · Modified
6.1EPSS 0.009
CVE-2020-35037
Events Manager < 5.9.8 - Cross-Site Scripting (XSS)
Published 2021-12-01 · Modified
6.1EPSS 0.009
CVE-2024-5889
Events Manager <= 6.4.8 - Reflected Cross-Site Scripting
Published 2024-06-29 · Modified
6.1EPSS 0.003
CVE-2025-6975
Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
Published 2025-07-09 · Analyzed
6.1EPSS 0.003
CVE-2018-0576
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 2018-05-14 · Modified
5.4EPSS 0.015
CVE-2019-16523
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
Published 2019-10-16 · Modified
5.4EPSS 0.012
CVE-2018-9020
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
Published 2018-03-26 · Modified
5.4EPSS 0.010
CVE-2018-13137
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
Published 2019-04-12 · Modified
4.8EPSS 0.012
CVE-2024-0614
Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings
Published 2024-03-13 · Modified
4.8EPSS 0.007
CVE-2024-2110
Events Manager <= 6.4.7.1 - Cross-Site Request Forgery
Published 2024-03-28 · Modified
4.3EPSS 0.002