CVE-2026-3218 | Medium | 4.8 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (X… |
CVE-2025-6976 | Medium | 6.4 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in a… |
CVE-2025-6975 | Medium | 6.1 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ para… |
CVE-2025-6970 | High | 7.5 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all v… |
CVE-2024-11260 | High | 7.5 | 2025-02-21 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in a… |
CVE-2024-5889 | Medium | 6.1 | 2024-06-29 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in… |
CVE-2024-3492 | Medium | 6.4 | 2024-06-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'locati… |
CVE-2024-30515 | Medium | 4.3 | 2024-06-09 | Missing Authorization vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.6.4. |
CVE-2024-30546 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Login With Ajax.This issue affects Login With Ajax: from n/a through 4.1. |
CVE-2024-30421 | Medium | 4.3 | 2024-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.7.1. |
CVE-2024-2111 | Medium | 6.4 | 2024-03-28 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value i… |
CVE-2024-2110 | Medium | 4.3 | 2024-03-28 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-0614 | Medium | 4.4 | 2024-03-13 | The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to in… |
CVE-2023-48326 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.This issue a… |
CVE-2022-3891 | Medium | 5.3 | 2023-02-13 | The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the… |
CVE-2020-35037 | Medium | 6.1 | 2021-12-01 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-S… |
CVE-2020-35012 | High | 7.2 | 2021-12-01 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection |
CVE-2019-16523 | Medium | 5.4 | 2019-10-16 | The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided… |
CVE-2013-7480 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. |
CVE-2013-7479 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. |
CVE-2013-7478 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. |
CVE-2013-7477 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. |
CVE-2012-6716 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. |
CVE-2015-9300 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. |
CVE-2015-9299 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS. |
CVE-2015-9298 | Critical | 9.8 | 2019-08-13 | The events-manager plugin before 5.6 for WordPress has code injection. |
CVE-2015-9297 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.6 for WordPress has XSS. |
CVE-2018-13137 | Medium | 4.8 | 2019-04-12 | The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-m… |
CVE-2018-0576 | Medium | 5.4 | 2018-05-14 | Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2018-9020 | Medium | 5.4 | 2018-03-26 | The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. |