Eventify – Events, Lists and Calendar

Eventify – Events, Lists and Calendar has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2011 and 2022; 1 is fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include SQL Injection.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2022.

2 independent researchers contributed these findings, one record each. Eventify – Events, Lists and Calendar is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all Eventify – Events, Lists and Calendar vulnerabilities before they are exploited.

Most severe open issueCVSS 5.5CVE-2022-4110

Eventify <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Eventify – Events, Lists and Calendar banner
Latestv3.0.6

Eventify – Events, Lists and Calendar

indefiniteloop

Author

indefiniteloop

3.0(1)
60/100
Last Updated
2026-10-18 (11d ago)
Active Installs
10+
Downloads
18,776
Requires WP
6.9+
Requires PHP
8.2+
Tested up to
WP 7.1.4
Created
2009-11-18 (17y ago)

Create and manage scheduled events in WordPress. Publish events as popup details or linked posts, display them in lists or calendars, and control who may submit events. Use native blocks, classic widgets, or shortcodes to place Eventify content throughout your site. Choose how each event is presented: * Popup events show event details without creating a WordPress post. * Post-backed events link to generated WordPress posts, subject to the post’s visibility and password settings. * Recurring events support fixed daily, weekly, and longer day intervals. Use blocks, widgets, or shortcodes to display event lists and calendars or to add submission forms. Forms follow an explicit role policy. Guest submissions can be enabled for popup events; creating linked posts requires a permitted, authenticated role. Eventify includes six-column CSV import and an eleven-column spreadsheet-safe CSV download. The download is intended for viewing, not as a file that can be imported back as a full-fidelity backup. See the CSV section below before importing data. Eventify does not remove event data, settings, or generated posts when deactivated, replaced, or deleted. Back up the database before upgrading. If an existing database schema is unsupported, Eventify reports an error rather than renumbering or replacing event IDs. Features Manage event titles, dates, start and end times, descriptions, venues, and timezone labels. Add upcoming event lists, calendars, and event submission forms with dynamic Gutenberg blocks. Keep classic widgets and existing shortcodes for established pages and themes. Choose popup details or linked WordPress posts for each event. Create recurring series with fixed intervals and an optional end date. Set submission permissions; public guest submissions are restricted to popup events. Import events from a six-column CSV and download an eleven-column spreadsheet-safe CSV. Customize calendar colors and the full calendar stylesheet from the Theme tab. Preserve existing event records, settings, and generated posts during upgrades. Shortcodes Calendar Add a calendar to a page or post: [eventifycalbig] Event list Display the next five events: [eventifytag displaytype="events" displayno="5"] Display events scheduled within the next seven days: [eventifytag displaytype="days" displayno="7"] displaytype accepts `events` or `days`; `displayno` sets the corresponding count or day range. Event submission form This example enables the public submission policy and restricts submissions to popup events: [eventifyform loggedin="user" popuponly="1"] Only use a public submission form where submissions are intended. Guest submissions can attract spam. Guest-created events cannot publish WordPress posts. Restrict post-backed submissions to trusted authenticated roles and pages. Gutenberg blocks Add Eventify blocks from the WordPress editor: Event List displays upcoming events or events within a day range. Choose the date format and list size. Eventify Calendar displays the interactive calendar on the published page; the editor uses a labeled placeholder. Eventify Submission Form follows the configured role policy and can be restricted to popup-only events. The blocks render from current Eventify data. Existing [eventifytag], [eventifycalbig], [eventifyform], and widget content remains supported. REST API The versioned API is available under /wp-json/eventify/v1. On sites without pretty permalinks, use WordPress’s ?rest_route=/eventify/v1/events route form instead. GET /events lists public, upcoming events. Use mode=days&amount=7 for a date range; page, per_page (maximum 100), and search support pagination and filtering. GET /events/{id} returns a public event. Events linked to private or password-protected posts are not exposed. GET /events?scope=all includes all visible events, including past events, and requires the manage_options capability. POST /events, PATCH /events/{id}, and DELETE /events/{id} require manage_options and normal WordPress REST authentication. PATCH updates only supplied fields. DELETE accepts associated=true to remove related event occurrences. Create requests accept title, date (YYYY-MM-DD), start_time, end_time, and optional description, venue, timezone, mode, repeat, repeat_interval, and repeat_until. Event writes use the same validation and storage as the Eventify admin screen. Existing data is not migrated to posts or another storage format. CSV import and download The import file uses six positional columns: title, date, time, description, venue, and timezone. Column names are not used to map fields. The included uploads/EventifyEg.csv file demonstrates the accepted layout. Import through Eventify → Import. Select a genuine .csv upload no larger than 5 MiB and containing no more than 10,000 data rows. The import validates the file before writing events. Imported events are popup-only and do not repeat. The downloaded CSV has eleven columns and is not a lossless import/restore file. Text that could be interpreted as a spreadsheet formula is escaped in the download only; stored event values are not changed. Compatibility and security Eventify 3.0.6’s event administration, submission forms, date/time controls, and frontend calendar were browser-checked on WordPress 7.1.3 with PHP 8.3.6. The minimum requirements are WordPress 6.9 and PHP 8.2. Event dates and times use the site’s local wall-clock values. Timezone choices are stored as labels; they do not convert the entered event time. Existing event dates and timestamps are not rewritten during upgrades. Recurrence uses fixed day intervals of 1, 7, 15, 30, 60, 120, 182, or 365 days. An optional end date is inclusive. Without one, occurrences are generated through three calendar years after the start; end dates beyond that horizon or series exceeding 1,100 occurrences are rejected. Editing changes only the selected occurrence. Deleting event rows does not delete linked WordPress posts. Public forms require a valid signed form context and same-origin request headers. Forms expire after one day. Changes to a widget’s enabled state or settings, or to the owning post’s content or visibility, invalidate its rendered submission context. Post-backed events respect linked-post visibility and password protection in event lists, calendars, and event details. Popup-only events are public. Calendar, form, and popup assets are self-hosted. FullCalendar 7.1.2 is included under its MIT license; no CDN is required.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C