High
CVE-2026-13441
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 45
Reset filters
High
CVE-2026-56053
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-42687
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-42686
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-42669
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization
Medium
CVE-2026-39518
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-25312
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization
High
CVE-2026-24378
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-69358
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.6.0 - Missing Authorization
Medium
CVE-2026-25389
EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure
Medium
CVE-2026-1655
EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
Medium
CVE-2026-1657
EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint
Medium
CVE-2026-24380
EventPrime <= 4.2.8.0 - Missing Authorization
Medium
CVE-2025-14507
EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API
Medium
CVE-2025-12498
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
Medium
CVE-2025-63006
EventPrime <= 4.2.4.1 - Missing Authorization
Medium
CVE-2025-63007
EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2024-13526
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export
High
CVE-2024-12024
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name
Medium
CVE-2024-4665
EventPrime – Events Calendar, Bookings and Tickets <= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update
Medium
CVE-2024-9864
EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-9865
EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log
Medium
CVE-2024-47648
EventPrime <= 4.0.4.5 - Open Redirect
Medium
CVE-2024-8369
EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.