Eventer - WordPress Event & Booking Manager Plugin

Eventer - WordPress Event & Booking Manager Plugin has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 10 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2025 was the busiest year with 10 disclosures.

The most common weakness is Missing Authorization, behind 3 of the records (25%). Other recurring categories include SQL Injection, Cross-Site Scripting.

10 of the records (83%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.

6 independent researchers contributed these findings, most of them (4) reported by István Márton.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage83%

Open

Fixed

Get automatic notifications for all Eventer - WordPress Event & Booking Manager Plugin vulnerabilities before they are exploited.

Most severe open issueCVSS 7.5CVE-2025-39481

Eventer <= 3.9.6 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

12 records


2026-07-07 16:30	Eventer <= 4.4.3 - Unauthenticated SQL Injection via 'code' Parameter Eventer - WordPress Event & Booking… <= 4.4.3	`CVE-2026-9700`	7.5 High	Rafie Muhammad	Yes
2026-07-07 16:30	Eventer <= 4.4.4 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation Eventer - WordPress Event & Booking… <= 4.4.4	`CVE-2026-9701`	9.8 Critical	Rafie Muhammad	Yes
2025-08-04 00:00	Eventer <= 3.11.2.1 - Unauthenticated Arbitrary Shortcode Execution Eventer - WordPress Event & Booking… <= 3.11.2.1	`CVE-2025-39483`	6.5 Medium	Bonds	Yes
2025-05-16 00:00	Eventer <= 3.9.6 - Unauthenticated SQL Injection Eventer - WordPress Event & Booking… <= 3.9.6	`CVE-2025-39481`	7.5 High	Nguyễn Trung Kiên	No
2025-05-16 00:00	Eventer <= 3.9.6 - Missing Authorization Eventer - WordPress Event & Booking… <= 3.9.6	`CVE-2025-39482`	4.3 Medium	Nguyễn Trung Kiên	No
2025-03-06 19:34	Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id Eventer - WordPress Event & Booking… <= 3.9.9.2	`CVE-2025-0959`	8.8 High	Lucio Sá	Yes
2025-02-14 00:00	Eventer <= 3.9.8 - Reflected Cross-Site Scripting Eventer - WordPress Event & Booking… <= 3.9.8	`CVE-2025-22635`	6.1 Medium	Nguyễn Trung Kiên	Yes
2025-02-03 00:00	Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download Eventer - WordPress Event & Booking… <= 3.9.9.5	`CVE-2024-11133`	5.3 Medium	István Márton	Yes
2025-02-03 00:00	Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Eventer - WordPress Event & Booking… <= 3.9.9.4	`CVE-2024-11132`	6.4 Medium	István Márton	Yes
2025-02-03 00:00	Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export Eventer - WordPress Event & Booking… <= 3.9.9	`CVE-2024-11134`	4.3 Medium	István Márton	Yes

Showing 1–10 of 12 reports