Unknown Event Booking Manager For Woocommerce vulnerabilities

6 CVEs affecting Unknown Event Booking Manager For Woocommerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-91077, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16062, published 2026-08-02. Medium severity, CVSS 6.6. EPSS: 0.6% chance of exploitation in the next 30 days. The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with…
CVE-2026-91019, published 2026-09-17. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and…
CVE-2026-91008, published 2026-09-17. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated…
CVE-2026-16064, published 2026-08-02. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global…
CVE-2026-16063, published 2026-08-02. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering…
CVE-2026-91077, published 2026-09-23. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level…