CVE-2026-77128: Missing Authorization

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

CVE-2026-53965: Uncontrolled Resource Consumption

The MCP PHP SDK Composer package mcp/sdk is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only...

CVE-2026-15023: Improper Neutralization of Special Elements used in an SQL Command

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-81122

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-81164

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em options save function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

The vulnerability of the perf_mmap_rb() function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the perfmmaprb function in the kernel/events/core.c module, which handles kernel event management in Linux operating systems, is related to the reuse of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

PT-2026-81165

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-81161

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-10627: Missing Authorization

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

The vulnerability of the `merge_sched_in()` function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, allows a hacker to cause a service failure.

The vulnerability of the mergeschedin function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, is related to the use of an unprotected alternative channel. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-78265

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78265

The Events Calendar WordPress plugin versions

WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Udin Chan in WordPress Plugin The Events Calendar versions = 6.17.2...

CVE-2026-28162

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

EUVD-2026-64793

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162

CVE-2026-28162 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Events Made Easy (versions ≤ 3.2.5 ). The vulnerability allows a remote unauthenticated attacker to inject and execute arbitrary script in another user's browser, with a CVSS 3.1 base score of 7....