Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Events Manager – Calendar, Bookings, Tickets, and more! Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 36 vulnerability records associated with Events Manager – Calendar, Bookings, Tickets, and more!, published between 2012 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

36Total records
1Critical
6High
28Medium
0Low
1Informational
36Patched records
0Currently marked unpatched
2012-05-22First disclosure
2026-07-08Latest disclosure
34 of 36CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201211 records
201322 records
201433 records
201544 records
201833 records
201911 records
202044 records
202311 records
202477 records
202588 records
202622 records

Severity Breakdown

SeverityRecordsShare
Critical12.8%
High616.7%
Medium2877.8%
Informational12.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

22 records61.1%

First: 2012. Latest: 2025.

Other

4 records11.1%

First: 2015. Latest: 2026.

SQL Injection

4 records11.1%

First: 2020. Latest: 2026.

CSRF

3 records8.3%

First: 2024. Latest: 2025.

Missing Authorization

2 records5.6%

First: 2024. Latest: 2025.

Information Disclosure

1 record2.8%

First: 2025. Latest: 2025.

Patch Status

Patched
36
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 7.3.7
  • 7.2.3
  • 7.2.2.3
  • 7.0.4
  • 6.6.5
  • 6.6.4.2
  • 6.6.4
  • 6.4.9
  • 6.4.8
  • 6.4.7.2
  • 6.4.7
  • 6.4.6
  • 5.9.8
  • 5.9.7.2
  • 5.9.6
  • 5.9.5
  • 5.9
  • 5.8.1.2
  • 5.6
  • 5.5.7.1
  • 5.5.7
  • 5.5.2
  • 5.3.9
  • 5.3.5
  • 5.5
  • 5.3.6.1
  • 5.1.7

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-5.9.5Events Manager <= 5.9.5 - Authenticated Stored Cross-Site ScriptingOctober 16, 20195.9.6Medium
*-5.9.4Events Manager <= 5.9.4 - Cross-Site ScriptingJuly 18, 20185.9.5Medium
[*, 5.9)Events Manager <= 5.8.1.3 - Stored Cross-Site ScriptingApril 27, 20185.9Medium
[*, 5.8.1.2)Events Manager <= 5.8.1.1 - Cross-Site ScriptingMarch 26, 20185.8.1.2Medium
[*, 5.6)Events Manager <= 5.5.7.1 - Code InjectionAugust 10, 20155.6Critical
[*, 5.6)Events Manager <= 5.5.7.1 - Cross-Site ScriptingAugust 10, 20155.6Medium
[*, 5.5.7.1)Events Manager < 5.5.7.1 - Cross-Site ScriptingJune 4, 20155.5.7.1Medium
[*, 5.5.7)Events Manager < 5.5.7 - Cross-Site ScriptingMay 23, 20155.5.7Medium
*-5.5.1Events Manager <= 5.5.1 - Multiple Cross-Site ScriptingAugust 1, 20145.5.2Medium
[*, 5.3.9)Events Manager < 5.3.9 - Cross-Site ScriptingAugust 1, 20145.3.9Medium
[*, 5.3.5)Events Manager < 5.3.5 & Events Manager Pro < 2.2.9 - Cross-Site ScriptingAugust 1, 20145.3.5Medium
[*, 5.5)Events Manager < 5.5 - Cross-Site ScriptingAugust 14, 20135.5Medium
*-5.3.6Events Manager <= 5.3.6 - Multiple Cross-Site ScriptingFebruary 27, 20135.3.6.1Medium
[*, 5.1.7)Events Manager < 5.1.7 - Cross-Site ScriptingMay 22, 20125.1.7Medium

Selected source records

Latest Records

HighCVE-2026-57713

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection

Published: July 8, 2026

Affected versions
*-7.3.6
Patched versions
7.3.7
Original Wordfence record
HighCVE-2026-12987

Events Manager <= 7.3.6 - Unauthenticated SQL Injection

Published: July 1, 2026

Affected versions
*-7.3.6
Patched versions
7.3.7
Original Wordfence record
MediumCVE-2025-12976

Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode

Published: December 17, 2025

Affected versions
*-7.2.2.1
Patched versions
7.2.3
Original Wordfence record
MediumCVE-2025-12407

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion

Published: December 11, 2025

Affected versions
*-7.2.2.2
Patched versions
7.2.2.3
Original Wordfence record
MediumCVE-2025-12408

Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure

Published: December 11, 2025

Affected versions
*-7.2.2.2
Patched versions
7.2.2.3
Original Wordfence record
MediumCVE-2025-6976

Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

Published: July 9, 2025

Affected versions
*-6.6.4.4; 7.0.1-7.0.3
Patched versions
6.6.5, 7.0.4
Original Wordfence record
HighCVE-2025-6970

Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter

Published: July 9, 2025

Affected versions
*-6.6.4.4; 7.0.1-7.0.3
Patched versions
6.6.5, 7.0.4
Original Wordfence record
MediumCVE-2025-6975

Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter

Published: July 9, 2025

Affected versions
*-6.6.4.4; 7.0.1-7.0.3
Patched versions
6.6.5, 7.0.4
Original Wordfence record

Highest-Severity Records

CriticalCVE-2015-9298

Events Manager <= 5.5.7.1 - Code Injection

Published: August 10, 2015

Affected versions
[*, 5.6)
Patched versions
5.6
Original Wordfence record
HighCVE-2026-57713

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection

Published: July 8, 2026

Affected versions
*-7.3.6
Patched versions
7.3.7
Original Wordfence record
HighCVE-2026-12987

Events Manager <= 7.3.6 - Unauthenticated SQL Injection

Published: July 1, 2026

Affected versions
*-7.3.6
Patched versions
7.3.7
Original Wordfence record
HighCVE-2025-6970

Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter

Published: July 9, 2025

Affected versions
*-6.6.4.4; 7.0.1-7.0.3
Patched versions
6.6.5, 7.0.4
Original Wordfence record
HighCVE-2024-11260

Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter

Published: February 20, 2025

Affected versions
*-6.6.3
Patched versions
6.6.4
Original Wordfence record
HighCVE-2020-35012

Events Manager <= 5.9.7.3 - Admin+ SQL Injection

Published: June 7, 2020

Affected versions
*-5.9.7.3
Patched versions
5.9.8
Original Wordfence record
High

Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection

Published: February 6, 2020

Affected versions
[*, 2.6.7.2)
Patched versions
2.6.7.2
Affected versions
[*, 5.9.7.2)
Patched versions
5.9.7.2
Original Wordfence record
MediumCVE-2025-12976

Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode

Published: December 17, 2025

Affected versions
*-7.2.2.1
Patched versions
7.2.3
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory