CVE-2025-12407

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'locationdelete' action. This makes it possible for unauthenticat...

CVE-2025-12407

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'locationdelete' action. This makes it possible for unauthenticat...

EUVD-2025-203074

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'locationdelete' action. This makes it possible for unauthenticat...

CVE-2025-12407 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'locationdelete' action. This makes it possible for unauthenticat...

CVE-2025-12407

The CVE-2025-12407 vector is a CSRF flaw in the WordPress plugin Event s Manager – Calendar, Bookings, Tickets, and more! that exists in versions up to and including 7.2.2.2. The issue stems from missing or incorrect nonce validation on the location_delete action, which could allow unauthenticate...

CVE-2025-12407 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'locationdelete' action. This makes it possible for unauthenticat...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion vulnerability

Cross-Site Request Forgery to Location Deletion vulnerability discovered by thinnawarth mathuros in WordPress Plugin Events Manager versions = 7.2.2.2...

My Calendar < 3.3.25 - Event/Location Deletion via CSRF

The plugin does not have CSRF checks when deleting events and locations, which could allow attackers to make logged in admins perform such actions via CSRF attacks...