¿Es seguro Events Manager?

Qué hace este plugin

• Slug: events-manager
• 70000+ instalaciones activas

blockbookingscalendareventstickets

Estado de mantenimiento

• Última versión conocida: 7.4.0.1
• Requiere PHP: 7.0+
• PHP máximo soportado (analizado): <8.0

Vulnerabilidades conocidas

30 CVEs conocidos registrados para Events Manager.

CVE-2026-57713

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 7.3.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-12976

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list_grouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-12407

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'location_delete' action. This makes it possible for unauthenticated attackers to delete locations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-12408

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-1249

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.6.4.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-11260

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-5889

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3492

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'location', and 'event_category' shortcodes in all versions up to, and including, 6.4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 35 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-30421	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.7.2	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 6.4.7.2	6.4.7.2	2024-03-28	✓ corregido en la última versión
CVE-2024-30515	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.7	Falta de control de autorización	Alta 8,8	< 6.4.7	6.4.7	2024-03-28	✓ corregido en la última versión
CVE-2024-2110	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.7.2	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 6.4.7.2	6.4.7.2	2024-03-27	✓ corregido en la última versión
CVE-2024-2111	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.7.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 6.4.7.2	6.4.7.2	2024-03-27	✓ corregido en la última versión
CVE-2024-0614	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 6.4.7	6.4.7	2024-02-28	✓ corregido en la última versión
CVE-2023-48326	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,1	< 6.4.6	6.4.6	2023-11-23	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8	—	Desconocido	< 5.9.8	5.9.8	2020-11-30	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8	—	Desconocido	< 5.9.8	5.9.8	2020-11-30	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8.2	—	Desconocido	< 5.9.8.2	5.9.8.2	2020-11-25	✓ corregido en la última versión
CVE-2020-35012	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,2	< 5.9.8	5.9.8	2020-06-07	✓ corregido en la última versión
CVE-2020-35037	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.9.8	5.9.8	2020-06-07	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2	—	Desconocido	< 5.9.7.2	5.9.7.2	2020-02-07	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2	—	Desconocido	< 5.9.7.2	5.9.7.2	2020-02-06	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2	—	Desconocido	< 5.9.7.2	5.9.7.2	2020-02-05	✓ corregido en la última versión
CVE-2019-16523	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 5.9.6	5.9.6	2019-10-16	✓ corregido en la última versión
CVE-2018-13137	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 5.9.5	5.9.5	2018-07-18	✓ corregido en la última versión
CVE-2018-0576	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 5.9	5.9	2018-04-27	✓ corregido en la última versión
CVE-2018-9020	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.8.1.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 5.8.1.2	5.8.1.2	2018-03-26	✓ corregido en la última versión
CVE-2015-9298	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.6	Control incorrecto de la generación de código (inyección de código)	Crítica 9,8	< 5.6	5.6	2015-08-10	✓ corregido en la última versión
CVE-2015-9297	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.6	5.6	2015-08-10	✓ corregido en la última versión
CVE-2015-9299	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.5.7.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.5.7.1	5.5.7.1	2015-06-04	✓ corregido en la última versión
CVE-2015-9300	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.5.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.5.7	5.5.7	2015-05-23	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.5.2	—	Desconocido	< 5.5.2	5.5.2	2015-05-15	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.3.9	—	Desconocido	< 5.3.9	5.3.9	2015-05-15	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.3.6	—	Desconocido	< 5.3.6	5.3.6	2015-05-15	✓ corregido en la última versión
CVE-2013-7477	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.5.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.5.2	5.5.2	2014-08-01	✓ corregido en la última versión
CVE-2013-7479	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.3.9	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.3.9	5.3.9	2014-08-01	✓ corregido en la última versión
CVE-2013-7478	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.5	5.5	2013-08-14	✓ corregido en la última versión
CVE-2013-7480	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.3.6.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.3.6.1	5.3.6.1	2013-02-27	✓ corregido en la última versión
CVE-2013-1407	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.3.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Desconocido	< 5.3.5	5.3.5	2013-01-19	✓ corregido en la última versión
CVE-2012-6716	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.1.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.1.7	5.1.7	2012-05-22	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.6.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 6.6.5	6.6.5	0000-00-00	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.6.5	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,5	< 6.6.5	6.6.5	0000-00-00	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.6.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 6.6.5	6.6.5	0000-00-00	✓ corregido en la última versión
—	Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2	—	Desconocido	< 5.9.7.2	5.9.7.2	—	✓ corregido en la última versión

CVE-2024-30421

Update the WordPress Events Manager plugin to the latest available version (at least 6.4.7.2). Dhabaleshwar Das discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Events Manager Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 6.4.7.2. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-30515

Update the WordPress Events Manager plugin to the latest available version (at least 6.4.7). Abdi Pranata discovered and reported this Broken Access Control vulnerability in WordPress Events Manager Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 6.4.7. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-2110

Update the WordPress Events Manager plugin to the latest available version (at least 6.4.7.2). Tim Coen discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Events Manager Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 6.4.7.2. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-2111

Update the WordPress Events Manager plugin to the latest available version (at least 6.4.7.2). Tim Coen discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Events Manager Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.4.7.2. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-0614

Update the WordPress Events Manager plugin to the latest available version (at least 6.4.7). Akbar Kustirama discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Events Manager Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.4.7. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-48326

Update the WordPress Events Manager plugin to the latest available version (at least 6.4.6). Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Events Manager Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.4.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8

Cross-Site Scripting (XSS) vulnerability found by Jakob Wierzba in WordPress Events Manager plugin (versions <= 5.9.7.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8

SQL Injection (SQLi) vulnerability found by Antony Garand in WordPress Events Manager plugin (versions <= 5.9.7.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.8.2

Authenticated Stored Cross-Site Scripting (XSS) vulnerability found by Nguyen Van Khanh in WordPress Events Manager plugin (versions <= 5.9.8.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2020-35012

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-35037

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2

CSV Injection vulnerability found by Vishnupriya Ilango in WordPress Events Manager plugin (versions <= 5.9.7.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2

The Events Manager Pro, versions up to 2.6.7.2, and Events Manager, versions up to 5.9.7.2, plugins for WordPress are vulnerable to CSV Injection. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2

The Events Manager plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 5.9.7.1 through the use of the Microsoft Excel DDE function. This allows low-privileged attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2019-16523

The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2018-13137

The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2018-0576

The WordPress plugin "Events Manager" provided by NetWebLogic contains a stored cross-site scripting vulnerability (CWE-79). Daichi Takaki of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: jvndb.jvn.jp

CVE-2018-9020

An unauthenticated user or a user without privileges, who can submit an event, can inject javascript code in the Google Maps miniature. The malicious code runs in the admin panel when a user with privileges opens the submitted event. The problem is in the file events-manager.js, the variable mapTitle is not escaped. 15/01/2018 – Events Manager is updated to version 5.8.1.2 and the vulnerability is fixed

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2015-9298

The Events Manager plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 5.5.7.1. This makes it possible for attackers to inject code onto the server and potentially execute it.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9297

The events-manager plugin before 5.6 for WordPress has XSS.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9299

The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS via the dbem_event_reapproved_email_body parameter.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9300

The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.5.2

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.3.9

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.3.6

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2013-7477

The Events Manager plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2013-7479

The Events Manager WordPress plugin was affected by a Multiple Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2013-7478

The Events Manager WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2013-7480

The Events Manager WordPress plugin was affected by a Multiple Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2013-1407

Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2012-6716

The Events Manager WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.6.5

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.6.5

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.6.5

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.7.2

The Events Manager WordPress plugin was affected by a CSV Injection security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Events Manager actualizado — 7.4.0.1 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• The Events Calendar — 700000+ instalaciones activas — 84/100 (2448)
• WP Events Manager — 30000+ instalaciones activas — 54/100 (13) — PHP máx. 8.4
• Timetable and Event Schedule by MotoPress — 30000+ instalaciones activas — 86/100 (68) — PHP máx. <8.0
• SimplyBook.me – Booking and reservations calendar — 30000+ instalaciones activas — 90/100 (17) — PHP máx. 8.4
• WP Simple Booking Calendar — 20000+ instalaciones activas — 96/100 (227)