Pixelite Events_manager
26 CVEs affecting Pixelite Events_manager. Latest disclosed: 2025-07-09. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-9298 | Critical | 9.8 | 2019-08-13 | The events-manager plugin before 5.6 for WordPress has code injection. |
CVE-2025-6970 | High | 7.5 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all v… |
CVE-2024-11260 | High | 7.5 | 2025-02-21 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in a… |
CVE-2020-35012 | High | 7.2 | 2021-12-01 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection |
CVE-2023-48326 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.This issue a… |
CVE-2025-6976 | Medium | 6.4 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in a… |
CVE-2024-3492 | Medium | 6.4 | 2024-06-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'locati… |
CVE-2024-2111 | Medium | 6.4 | 2024-03-28 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value i… |
CVE-2025-6975 | Medium | 6.1 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ para… |
CVE-2024-5889 | Medium | 6.1 | 2024-06-29 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in… |
CVE-2020-35037 | Medium | 6.1 | 2021-12-01 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-S… |
CVE-2013-7480 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. |
CVE-2013-7479 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. |
CVE-2013-7478 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. |
CVE-2013-7477 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. |
CVE-2012-6716 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. |
CVE-2015-9300 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. |
CVE-2015-9299 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS. |
CVE-2015-9297 | Medium | 6.1 | 2019-08-13 | The events-manager plugin before 5.6 for WordPress has XSS. |
CVE-2019-16523 | Medium | 5.4 | 2019-10-16 | The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided… |