Wp Events Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wp_events_manager:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wp Events Manager (9ed938ae-468c-5c3d-ba6b-3ac71c03c2ad) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14205 |
vulnerable | 2026-09-16 04:33:12.518150 |
WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
Published: 2026-08-07T06:00:10.362Z
Updated: 2026-08-07T18:01:41.454Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15148 |
vulnerable | 2026-09-16 04:33:06.713835 |
WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR
MEDIUM (5.3)
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
Published: 2026-08-07T07:25:34.488Z
Updated: 2026-08-07T15:22:14.431Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.