wp_event_manager vulnerabilities
CVEs whose affected-version data names the wp_event_manager package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-86442High· 8.2WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the co…
▾ TwilightEPSS 0.19%via CVEORG
CVE-2026-16304High· 8.1WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to re…
▾ TwilightEPSS 0.20%via CVEORG