Event Registration

Event Registration has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2010 and 2016; all 4 are fixed as of October 2026. Their average CVSS score is 9.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 1 high. 2016 was the busiest year with 3 disclosures.

The most common weakness is SQL Injection, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.

Every one of the 4 issues recorded for Event Registration has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (3) reported by Michael Helwig. Event Registration is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSCritical

9.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Event Registration vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

Event Registration <= 6.02.02 - PHP Object Injection

Read the full analysis

Vulnerability Records

4 records


2016-05-09 00:00	Event Registration <= 6.02.02 - PHP Object Injection Event Registration <= 6.02.02	`N/A`	9.8 Critical	Michael Helwig	Yes
2016-05-09 00:00	Event Registration <= 6.02.02 - SQL Injection Event Registration <= 6.02.02	`N/A`	9.8 Critical	Michael Helwig	Yes
2016-05-09 00:00	Event Registration <= 6.02.02 - Unauthenticated Stored Cross-Site Scripting Event Registration <= 6.02.02	`N/A`	7.2 High	Michael Helwig	Yes
2010-11-15 00:00	Event Registration < 6.00.03 - SQL Injection Event Registration < 6.00.03	`CVE-2010-4839`	9.8 Critical	k3m4n9i	Yes

Showing 1–4 of 4 reports

Latestv7.0.1

Event Registration

Author

avdude

3.8(22)

76/100

Last Updated

2026-10-08 (20d ago)

Active Installs

100+

Downloads

153,867

Requires WP

6.9+

Requires PHP

8.2+

Tested up to

WP 7.1.3

Created

2008-10-03 (18y ago)

Event Registration lets you publish events, collect registrations with custom questions, manage attendees and waitlists, and record payments. Events with dates, venues, capacity, waitlists, and categories Ticket types with prices, limits, and sales windows Custom registration questions A simple two-step registration form that works with any theme, with spam protection built in Offline payments (check, cash, pay at the door), payment receipts, and balances Registrations screen with search, filters, CSV import and export Calendar, upcoming events list, and “add to calendar” files Blocks and shortcodes Works with WordPress’s privacy tools (export and erase personal data) One-time importer for Event Registration 6.x data Version 7.0 is a complete rewrite. See the upgrade notice before updating from 6.x. Privacy Event Registration stores the information people enter when they register (names, contact details, answers, and payment records) in your site’s database. It does not send data to any external service. It integrates with WordPress’s Export and Erase Personal Data tools, and adds suggested text to your privacy policy guide. External services This plugin does not connect to any external services. It makes no remote requests and loads no files from other websites. Calendar (.ics) files are generated on your own site.

View on WordPress.org