Skip to contentMetagauss Eventprime vulnerabilities
- metagauss eventprimeEventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status OverrideCVE-2026-1185235.3 Medium
- eventprimeWordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerabilityCVE-2026-426915.4 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' ParameterCVE-2026-134417.2 High
- eventprimeWordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerabilityCVE-2026-560538.8 High
- eventprimeWordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerabilityCVE-2026-426878.1 High
- eventprimeWordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-426867.1 High
- eventprimeWordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-395187.1 High
- eventprimeWordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerabilityCVE-2026-426697.5 High
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerabilityCVE-2026-243789.8 Critical
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerabilityCVE-2025-693587.5 High
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerabilityCVE-2026-253127.5 High
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerabilityCVE-2026-253895.3 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' ParameterCVE-2026-16554.3 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX EndpointCVE-2026-1657Public exploit5.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerabilityCVE-2026-243805.3 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST APICVE-2025-145075.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerabilityCVE-2025-630074.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerabilityCVE-2025-630064.3 Medium
- metagauss eventprime – events calendar, bookings and ticketsEventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note CreationCVE-2025-124984.3 Medium
- metagauss eventprimeEventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings updateCVE-2024-46656.4 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees ExportCVE-2024-135264.3 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type NameCVE-2024-120247.2 High
- eventprime events eventprimeWordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerabilityCVE-2024-432234.3 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-98646.1 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction LogCVE-2024-98656.1 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerabilityCVE-2024-476484.7 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events DisclosureCVE-2024-83695.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerabilityCVE-2024-312758.2 High
- metagauss eventprimeWordPress EventPrime plugin <= 2.8.6 - Sensitive Data ExposureCVE-2023-333215.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-297765.9 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerabilityCVE-2024-248328.2 High
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List RetrievalCVE-2024-11264.3 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment BypassCVE-2024-13215.3 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event ExportCVE-2024-11274.3 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionCVE-2024-11255.4 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-13206.5 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post OverwriteCVE-2024-11236.5 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email SendingCVE-2024-11244.3 Medium
- metagauss eventprimeEventPrime < 3.3.6 - Unauthenticated Event AccessCVE-2023-64475.3 Medium
- metagauss eventprimeEventPrime <= 3.2.9 - Booking Pricing BypassCVE-2023-42525.3 Medium
- metagauss eventprimeEventPrime < 3.2.0 - Reflected XSSCVE-2023-42506.1 Medium
- metagauss eventprimeEventPrime < 3.2.0 - Booking Creation via CSRFCVE-2023-42514.3 Medium
- metagauss eventprimeEventPrime < 3.2.0 - Booking Creation via CSRFCVE-2023-55194.3 Medium
- metagauss eventprimeEventPrime < 3.2.0 - Reflected HTML Injection on keyword parameterCVE-2023-52386.1 Medium
- eventprime – events calendar, bookings and tickets, metagauss eventprime, eventprime – events calendar, bookings and tickets +2 moreWordPress EventPrime Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)CVE-2023-456377.1 High
- eventprimeWordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)CVE-2023-358847.1 High
- eventprimeWordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)CVE-2023-333267.1 High