Unknown Events Manager vulnerabilities

6 CVEs affecting Unknown Events Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93662, published 2026-09-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18366, published 2026-08-12. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions,…
CVE-2026-12987, published 2026-07-22. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as…
CVE-2026-18050, published 2026-08-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve…
CVE-2026-18057, published 2026-08-12. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to…
CVE-2026-93662, published 2026-09-24. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read…
CVE-2026-93661, published 2026-09-24. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one…