CVE-2025-12407
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 7.2.2.2. This is due to missing or incorrect nonce validation on the 'location_delete' action, allowing unauthenticated attackers to delete locations via a forged request if they can trick a site administrator into clicking a link.
Risk Assessment
The risk includes the possibility of an attacker deleting locations, which could lead to data loss and disruption of event operations.
Recommendation
It is recommended to update the Events Manager plugin to a version newer than 7.2.2.2 if available, and implement CSRF protection mechanisms.
Other vulnerabilities in Events Manager
See all- CVE-2026-18366Critical
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the plugin's own posts.
- CVE-2026-114694High
The WordPress plugin Events Manager up to version 7.4.8 is vulnerable to reflected XSS due to improper neutralization of input during web page generation. An attacker could trick a user into clicking a crafted link, leading to execution of a malicious script.
- CVE-2026-42689Low
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions. This issue affects Events Manager: from n/a through 7.4.7.
- CVE-2026-42633High
SQL Injection vulnerability in Events Manager plugin up to version 7.4.6, requiring subscriber privileges. Allows a user with subscriber role to inject malicious SQL queries into the database.
- CVE-2026-105068Medium
An Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data. This issue affects Events Manager from n/a through 7.4.5.
- CVE-2026-93662Medium
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
- CVE-2026-17089Medium
The Events Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in versions up to and including 7.4.0.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link.
- CVE-2026-14280Medium
The Events Manager plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 7.3.7.4 via the em_options_save function. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server, leading to code execution or data exposure.
- CVE-2026-10627Medium
The Events Manager plugin for WordPress is vulnerable to authorization bypass in versions up to and including 7.4.0. Unauthenticated attackers can view titles, dates, descriptions, and location details of events and locations marked as draft, pending, trashed, or private.
- CVE-2026-15023Medium
The Events Manager plugin for WordPress up to version 7.4.0 is vulnerable to SQL injection via the 'meta_key' parameter in the event/location duplicate action. Attackers with contributor-level access can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'location_delete' action. This makes it possible for unauthenticated attackers to delete locations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS