Plugin security history

EventPrime – Events Calendar, Bookings and Tickets Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 45 vulnerability records associated with EventPrime – Events Calendar, Bookings and Tickets, published between 2023 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

45Total records

0Critical

5High

40Medium

0Low

0Informational

45Patched records

0Currently marked unpatched

2023-05-22First disclosure

2026-07-08Latest disclosure

44 of 45CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	10	10 records
2024	17	17 records
2025	4	4 records
2026	14	14 records

Severity Breakdown

Severity	Records	Share
High	5	11.1%
Medium	40	88.9%

Vulnerability-Type Breakdown

Missing Authorization

20 records44.4%

First: 2023. Latest: 2026.

Cross-Site Scripting

12 records26.7%

First: 2023. Latest: 2026.

Other

8 records17.8%

First: 2023. Latest: 2026.

Information Disclosure

4 records8.9%

First: 2023. Latest: 2026.

CSRF

1 record2.2%

First: 2023. Latest: 2023.

Patch Status

Patched: 45
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.3.4.3
4.3.4.2
4.3.2.2
4.3.2.1
4.3.0.1
4.2.7.0
4.2.8.4
4.2.8.5
4.2.8.1
4.2.8.0
4.2.0.1
4.2.5.0
4.0.7.4
3.5.0
4.0.4.8
4.0.4.6
4.0.4.4
4.0.4.0
3.3.5
3.4.3
3.4.4
3.4.2
3.4.0
3.3.6
3.3.3
3.1.6
3.2.0
3.0.0
3.0.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.3.4`	EventPrime <= 3.3.4 - Missing Authorization to Booking Price Maniputlation	April 5, 2024	3.3.5	Medium
`*-3.3.9`	EventPrime <= 3.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting	March 25, 2024	3.4.0	Medium
`*-3.4.3`	EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	March 8, 2024	3.4.4	Medium
`*-3.4.3`	EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting	March 8, 2024	3.4.4	Medium
`*-3.4.2`	EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass	March 8, 2024	3.4.3	Medium
`*-3.4.2`	EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite	March 8, 2024	3.4.3	Medium
`*-3.4.3`	EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending	March 8, 2024	3.4.4	Medium
`*-3.4.2`	EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval	February 14, 2024	3.4.3	Medium
`*-3.4.1`	EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export	February 14, 2024	3.4.2	Medium
`*-3.3.9`	EventPrime <= 3.3.9 - Improper Input Validation via save_event_booking	February 2, 2024	3.4.0	Medium
`*-3.3.5`	EventPrime <= 3.3.5 - Missing Authorization to Private Event Disclosure	December 29, 2023	3.3.6	Medium
`*-3.3.2`	EventPrime – Modern Events Calendar, Bookings and Tickets <= 3.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode	November 21, 2023	3.3.3	Medium
`*-3.3.2`	EventPrime <= 3.3.2 - Improper Server-Side Checks to Booking Payment Bypass	October 30, 2023	3.3.3	Medium
`*-3.1.5`	EventPrime <= 3.1.5 - Reflected Cross-Site Scripting via 'event_id'	October 11, 2023	3.1.6	Medium
`[*, 3.2.0)`	EventPrime < 3.2.0 - Reflected HTML Content Injection	October 9, 2023	3.2.0	Medium
`[*, 3.2.0)`	EventPrime < 3.2.0 - Cross-Site Request Forgery	October 9, 2023	3.2.0	Medium
`[*, 3.2.0)`	EventPrime < 3.2.0 - Reflected Cross-Site Scripting via keyword and ep_filter_date	October 9, 2023	3.2.0	Medium
`*-2.8.6`	EventPrime <= 2.8.6 - Reflected Cross-Site Scripting	May 22, 2023	3.0.0	Medium
`*-2.8.6`	EventPrime <= 2.8.6 - Sensitive Information Exposure	May 22, 2023	3.0.0	Medium
`*-3.0.5`	EventPrime <= 3.0.5 - Reflected Cross-Site Scripting	May 22, 2023	3.0.6	Medium

Selected source records

Latest Records

HighCVE-2026-13441

EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

Published: July 8, 2026

Affected versions: *-4.3.4.2
Patched versions: 4.3.4.3

Original Wordfence record

HighCVE-2026-56053

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection

Published: June 25, 2026

Affected versions: *-4.3.4.1
Patched versions: 4.3.4.2

Original Wordfence record

HighCVE-2026-42687

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection

Published: May 25, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

MediumCVE-2026-42686

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: May 24, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

MediumCVE-2026-42669

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization

Published: May 12, 2026

Affected versions: *-4.3.2.0
Patched versions: 4.3.2.1

Original Wordfence record

MediumCVE-2026-39518

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference

Published: April 20, 2026

Affected versions: *-4.3.0.0
Patched versions: 4.3.0.1

Original Wordfence record

MediumCVE-2026-25312

EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization

Published: March 18, 2026

Affected versions: *-4.2.8.3
Patched versions: 4.2.8.4

Original Wordfence record

HighCVE-2026-24378

EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection

Published: March 17, 2026

Affected versions: *-4.2.8.0
Patched versions: 4.2.8.1

Original Wordfence record

Highest-Severity Records

HighCVE-2026-24378

EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection

Published: March 17, 2026

Affected versions: *-4.2.8.0
Patched versions: 4.2.8.1

Original Wordfence record

HighCVE-2026-42687

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection

Published: May 25, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

HighCVE-2026-56053

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection

Published: June 25, 2026

Affected versions: *-4.3.4.1
Patched versions: 4.3.4.2

Original Wordfence record

HighCVE-2026-13441

EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

Published: July 8, 2026

Affected versions: *-4.3.4.2
Patched versions: 4.3.4.3

Original Wordfence record

HighCVE-2024-12024

EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name

Published: December 16, 2024

Affected versions: *-4.0.7.3
Patched versions: 4.0.7.4

Original Wordfence record

MediumCVE-2024-1123

EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite

Published: March 8, 2024

Affected versions: *-3.4.2
Patched versions: 3.4.3

Original Wordfence record

MediumCVE-2024-1320

EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting

Published: March 8, 2024

Affected versions: *-3.4.3
Patched versions: 3.4.4

Original Wordfence record

MediumCVE-2026-42686

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: May 24, 2026

Affected versions: *-4.3.2.1
Patched versions: 4.3.2.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory