Unknown WP Events Manager vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown WP Events Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2026-14205unknownwp events manager+1
EPSS score
0.48%
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.5.3CVE-2026-15148unknownwp events manager+1
EPSS score
0.16%
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.