It’s been a busy few weeks. Events Manager 7.4.4 and 7.4.5 are both out now, along with Pro 3.9.2 and 3.9.3, and if you haven’t updated yet then today’s a good day to.
Between the two core releases we’ve patched up a few more security vulnerabilities. All of them were responsibly disclosed and all of them were fixed and shipped before this post went live. Our thanks to the researchers who found them, and to Patchstack, Wordfence and WPScan for getting them to us.
We’ve got some exciting things in the pipeline, and we’ll have more to say about those when they’re ready to show. In the meantime we’ve been using these releases to close out long-standing bugs, including a few that have been on our list longer than we’d like.
So the rest is bug fixing, and there’s a good amount of it: bookings on cached sites, recurring events and their occurrences, a scattering of admin and block editor annoyances. Pro’s two releases lean toward waiting lists and payments, with a few PDF and email fixes alongside.
Full changelogs below.
Events Manager 7.4.4 and 7.4.5
- Security: Fixed a broken access control vulnerability. Reported by Hasyros via WPScan.
- Security: Fixed an information disclosure vulnerability. Reported by Karthik Ramakrishnan via WPScan.
- Security: Fixed an information disclosure vulnerability. Reported via Patchstack.
- Security: Fixed a missing authorization vulnerability, CVE-2026-92711. Reported by M4r0u4n3 via Wordfence.
- Security: Fixed a spoofing vulnerability, CVE-2026-92614. Reported by Shirshak via Wordfence.
- Added: em_get_my_bookings_url() accepts a person id and runs through the em_get_my_bookings_url filter, so BuddyPress links resolve the booking owner rather than the displayed user
- Changed: the admin bookings list and pending badge now show only the event type you are viewing, with an All Event Types filter for the combined list
- Fixed: newly booked attendees did not show on the event page until caches were flushed on sites with a persistent object cache, the event was cached with an emptied bookings list and never invalidated when bookings changed
- Fixed: booking submissions on cached sites failed with “unexpected network error” once the form’s security token expired, the form now says it expired and should be reloaded
- Fixed: the booking form security token was only refreshed for the standard booking form on cached sites
- Fixed: deleting a recurring event’s bookings reported success without deleting anything
- Fixed: repeating event occurrences had every previous occurrence’s date appended to their slug, breaking their URLs
- Fixed: the waiting list could not be joined for a fully booked occurrence of a recurring event
- Fixed: the pending spaces count ignored a forced refresh and could stay stale after a booking
- Fixed: events with an emoji in their name or content could not be saved on older database tables
- Fixed: events created by imports or the REST API were missing from listings until re-saved because their type and archetype were never set, existing events are repaired on upgrade
- Fixed: events using a custom archetype could not be edited, reporting “Sorry, you are not allowed to edit this post”
- Fixed: publishing an event in the block editor saved it as a draft when pre-publish checks were disabled
- Fixed: an end time earlier than the start time was not flagged while editing an event
- Fixed: an event ending after midnight on a later day was flagged as ending before it started
- Fixed: calendar date previews still rendered their modals when Date Preview Mode was set to Direct Link
- Fixed: the day view of the events page could not be paginated
- Fixed: the events search form could submit to the default language events page under WPML, and to the wrong page on themes overriding the search template
- Fixed: an empty events page setting could write a rewrite rule that broke the page being viewed until rewrite rules regenerated
- Fixed: fatal error on the category page after updating when an archetype has both categories and tags disabled
- Fixed: fatal error on first activation from WP-CLI or other non-admin contexts because the admin notice class was not loaded
- Fixed: scheduled imports failed because wp-cron and WP-CLI requests were subject to the public submitter consent check
- Fixed: the booking meta migration from 6.1 could rerun on every page load when a batch of bookings had no meta, slowing or crashing the site after an upgrade
- Fixed: bookings with a zero booking date in the database displayed as “November 29, -0001”
- Fixed: bulk actions such as Move to Trash in the admin failed to redirect due to a warning from the archetype post type check
- Fixed: deleting a booking from the admin bookings table still rendered its row actions and could print a warning into the response
- Fixed: admin booking tables could stop responding when the export or settings form was picked up before the main table form, notably on multisite
- Fixed: the booking submit button read “null” after an AJAX submission
- Fixed: radio buttons were invisible on the admin Add Booking form due to checkbox styling applied to radios
- Fixed: the edit icon in the admin bookings list spilled out of its column on narrow screens
- Fixed: a PHP warning was printed above the header row of CSV booking exports
- Fixed: a PHP deprecation notice was printed on the admin bookings pages when debugging was enabled
- Fixed: uninstalling from a sub-site in MS Global mode dropped the shared network event and booking tables, it is now refused with a link to the network settings
- Fixed: the bookings admin page turned the URL action into a booking lifecycle hook name, so listeners of em_bookings_add could fatal, a dedicated em_bookings_admin_action_* hook now fires alongside the legacy name
- Fixed: the REST API bookings list only returned bookings on the caller’s own events, even for users who can manage all bookings
- Fixed: the Test Email Settings button reported “Server Error” for administrators without the activate_plugins capability
- Fixed: EM_Event::set_timeslot_id() could never load a timeslot due to malformed SQL
- Tweaked: typo on the help page
Events Manager Pro 3.9.2 and 3.9.3
- Fixed: Quick Pay bookings were always created as Offline when more than one payment button was shown, breaking PayPal checkout
- Fixed: Unpaid bookings never expiring when only a payment method’s own Unpaid Bookings Expiry was set, and expiring after one minute when the expiry did run
- Fixed: Bookings awaiting payment holding their spaces indefinitely when no unpaid booking expiry was set, spaces are now held only while an expiry can release them
- Fixed: Spaces for a booking awaiting payment counted twice, which could show an event as full before it was
- Fixed: Payment method buttons rendering blank when their label setting had been saved empty, the payment method name is used again
- Fixed: Manual booking Amount Paid field defaulting to whitespace, causing an “Invalid payment amount” error
- Fixed: Waiting list unreachable on a fully booked occurrence of a recurring event, the signup form is now offered on the occurrence being viewed
- Fixed: Joining a waiting list failing with an “Unrecognized action” message on cached sites, the form’s security token is now refreshed and an expired one is reported plainly
- Fixed: Approving a waiting list booking could leave the booking form missing, log a temp_event_rsvp_spaces warning and release the held space to someone else
- Fixed: Waiting list approval emails could link to another member’s bookings page on BuddyPress sites
- Fixed: Booking reminders queued again every minute and sent repeatedly, the cron guard never matched its own schedule and nothing recorded a reminder as sent
- Fixed: Send Emails recipient estimate and send skipping waiting list bookings, which carry no ticket type
- Fixed: Ticket scanning and the frontend bookings manager returning a 404 until permalinks were re-saved, the endpoint now registers itself when the feature is enabled
- Fixed: Logo missing from PDF tickets and invoices, rendered as “Image not found” because the PDF renderer could not load it
- Fixed: Malformed title tag in the booking PDF template, which left the generated PDF with no document title
- Fixed: Booking form fields marked required blocking user profile saves in wp-admin
- Fixed: Attendee migration failing with a SQL error on legacy meta keys, leaving attendee data unmigrated
- Fixed: Typos in the waiting list and past events settings descriptions
Thanks, as always, for trusting us with your events, your attendees and their data.