Plugin security history

EventPrime – Events Calendar, Bookings and Tickets Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 45 vulnerability records associated with EventPrime – Events Calendar, Bookings and Tickets, published between 2023 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

45Total records

0Critical

5High

40Medium

0Low

0Informational

45Patched records

0Currently marked unpatched

2023-05-22First disclosure

2026-07-08Latest disclosure

44 of 45CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	10	10 records
2024	17	17 records
2025	4	4 records
2026	14	14 records

Severity Breakdown

Severity	Records	Share
High	5	11.1%
Medium	40	88.9%

Vulnerability-Type Breakdown

Missing Authorization

20 records44.4%

First: 2023. Latest: 2026.

Cross-Site Scripting

12 records26.7%

First: 2023. Latest: 2026.

Other

8 records17.8%

First: 2023. Latest: 2026.

Information Disclosure

4 records8.9%

First: 2023. Latest: 2026.

CSRF

1 record2.2%

First: 2023. Latest: 2023.

Patch Status

Patched: 45
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.3.4.3
4.3.4.2
4.3.2.2
4.3.2.1
4.3.0.1
4.2.7.0
4.2.8.4
4.2.8.5
4.2.8.1
4.2.8.0
4.2.0.1
4.2.5.0
4.0.7.4
3.5.0
4.0.4.8
4.0.4.6
4.0.4.4
4.0.4.0
3.3.5
3.4.3
3.4.4
3.4.2
3.4.0
3.3.6
3.3.3
3.1.6
3.2.0
3.0.0
3.0.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.3.4.2`	EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter	July 8, 2026	4.3.4.3	High
`*-4.3.4.1`	EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection	June 25, 2026	4.3.4.2	High
`*-4.3.2.1`	EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection	May 25, 2026	4.3.2.2	High
`*-4.3.2.1`	EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting	May 24, 2026	4.3.2.2	Medium
`*-4.3.2.0`	EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization	May 12, 2026	4.3.2.1	Medium
`*-4.3.0.0`	EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference	April 20, 2026	4.3.0.1	Medium
`*-4.2.8.3`	EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization	March 18, 2026	4.2.8.4	Medium
`*-4.2.8.0`	EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection	March 17, 2026	4.2.8.1	High
`*-4.2.6.0`	EventPrime – Events Calendar, Bookings and Tickets <= 4.2.6.0 - Missing Authorization	March 10, 2026	4.2.7.0	Medium
`*-4.2.8.3`	EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure	February 20, 2026	4.2.8.4	Medium
`*-4.2.8.4`	EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter	February 17, 2026	4.2.8.5	Medium
`*-4.2.8.4`	EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint	February 16, 2026	4.2.8.5	Medium
`*-4.2.8.0`	EventPrime <= 4.2.8.0 - Missing Authorization	January 28, 2026	4.2.8.1	Medium
`*-4.2.7.0`	EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API	January 12, 2026	4.2.8.0	Medium
`*-4.2.0.0`	EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation	November 7, 2025	4.2.0.1	Medium
`*-4.2.4.1`	EventPrime <= 4.2.4.1 - Missing Authorization	November 6, 2025	4.2.5.0	Medium
`*-4.2.4.1`	EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure	November 6, 2025	4.2.5.0	Medium
`*-4.0.7.3`	EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export	March 6, 2025	4.0.7.4	Medium
`*-4.0.7.3`	EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name	December 16, 2024	4.0.7.4	High
`*-3.4.9`	EventPrime – Events Calendar, Bookings and Tickets <= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update	October 29, 2024	3.5.0	Medium
`*-4.0.4.7`	EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting	October 23, 2024	4.0.4.8	Medium
`*-4.0.4.7`	EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log	October 23, 2024	4.0.4.8	Medium
`*-4.0.4.5`	EventPrime <= 4.0.4.5 - Open Redirect	September 30, 2024	4.0.4.6	Medium
`*-4.0.4.3`	EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure	September 9, 2024	4.0.4.4	Medium
`*-4.0.3.2`	EventPrime <= 4.0.3.2 - Missing Authorization via calendar_event_create()	August 9, 2024	4.0.4.0	Medium

Selected source records

Latest Records

HighCVE-2026-13441

EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

Published: July 8, 2026

Affected versions: *-4.3.4.2
Patched versions: 4.3.4.3

Original Wordfence record

HighCVE-2026-56053

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection

Published: June 25, 2026

Affected versions: *-4.3.4.1
Patched versions: 4.3.4.2

Original Wordfence record

HighCVE-2026-42687

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection

Published: May 25, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

MediumCVE-2026-42686

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: May 24, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

MediumCVE-2026-42669

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization

Published: May 12, 2026

Affected versions: *-4.3.2.0
Patched versions: 4.3.2.1

Original Wordfence record

MediumCVE-2026-39518

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference

Published: April 20, 2026

Affected versions: *-4.3.0.0
Patched versions: 4.3.0.1

Original Wordfence record

MediumCVE-2026-25312

EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization

Published: March 18, 2026

Affected versions: *-4.2.8.3
Patched versions: 4.2.8.4

Original Wordfence record

HighCVE-2026-24378

EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection

Published: March 17, 2026

Affected versions: *-4.2.8.0
Patched versions: 4.2.8.1

Original Wordfence record

Highest-Severity Records

HighCVE-2026-24378

EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection

Published: March 17, 2026

Affected versions: *-4.2.8.0
Patched versions: 4.2.8.1

Original Wordfence record

HighCVE-2026-42687

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection

Published: May 25, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

HighCVE-2026-56053

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection

Published: June 25, 2026

Affected versions: *-4.3.4.1
Patched versions: 4.3.4.2

Original Wordfence record

HighCVE-2026-13441

EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

Published: July 8, 2026

Affected versions: *-4.3.4.2
Patched versions: 4.3.4.3

Original Wordfence record

HighCVE-2024-12024

EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name

Published: December 16, 2024

Affected versions: *-4.0.7.3
Patched versions: 4.0.7.4

Original Wordfence record

MediumCVE-2024-1123

EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite

Published: March 8, 2024

Affected versions: *-3.4.2
Patched versions: 3.4.3

Original Wordfence record

MediumCVE-2024-1320

EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting

Published: March 8, 2024

Affected versions: *-3.4.3
Patched versions: 3.4.4

Original Wordfence record

MediumCVE-2026-42686

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: May 24, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory