CVE-2026-14205

CVE-2026-14205 affects the WP Events Manager WordPress plugin prior to 2.2.5. The vulnerability arises because the plugin does not validate the requested quantity when registering for a paid event, so the price is computed from an attacker-controlled quantity. This allows any authenticated user t...

CVE-2026-14205 WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...

EUVD-2024-48597

Malicious code in bioql PyPI...

CVE-2025-57987

Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Events Manager: from n/a through = 2.2.1...

PT-2025-38837

Name of the Vulnerable Software and Affected Versions WP Events Manager versions through 2.2.1 Description A missing authorization issue exists in ThimPress WP Events Manager. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access...

CVE-2024-7717

CVE-2024-7717 – In WP Events Manager for WordPress, there is a time-based SQL Injection in the order parameter affecting all versions up to 2.1.11. Exploitation requires Subscriber+ level authentication and can cause injection of additional SQL to extract sensitive data. According to connected RH...