This update fixes another round of security issues of varying severity. We recommend updating now.
We apologize for the repeated warnings and what may feel like a new security update every other day. With AI tooling now in everyone’s hands, and our code being open source, the plugin is being scrutinized more closely than ever before. We welcome it, and hope that every one of these updates leaves us stronger.
This one is a case in point. It came from a customer, Alexander Ströher, who ran his own AI-assisted review of the plugin and disclosed what he found directly to us, responsibly. He is credited in the changelogs below, and we’d like to thank him for the contribution.
On that note, anyone is welcome to have a go and see what they find. Email us at security@wp-events-plugin.com. This is an experiment in the open, and we’re curious to see where it leads.
If you run an older Pro version and can’t update to 3.9.6 yet, patched builds for the 2.8 and 3.0 to 3.8 lines are available from your account downloads, alongside the ones released in August.
Events Manager 7.4.8
- Security: Fixed a clickjacking vulnerability and restricted the permissions granted to AI/MCP connections. Reported by Alexander Ströher.
- Security: Fixed a cross-site scripting vulnerability. Reported by Alexander Ströher.
- Security: Fixed an information disclosure vulnerability in the REST API. Reported by Alexander Ströher.
- Security: Additional hardening of the OAuth endpoints, uploads and search parameters.
- Fixed: Calendars with long_events enabled hid timed events on the last displayed day of the grid
- Fixed: Location searches with array coordinates, country-name lookups and timezone-scoped date ranges returned wrong results
- Fixed: REST API events and bookings endpoints returned an error for some search parameters
- Fixed: Missing text domain in the general settings tab
Events Manager Pro 3.9.6
- Security: Fixed an authenticated SQL injection vulnerability. Reported by Alexander Ströher.
- Security: Fixed a cross-site scripting vulnerability in the admin area. Reported by Alexander Ströher.
- Security: Additional hardening of file downloads, the uploads directory and legacy gateway code.
- Security: Updated the bundled PDF library to its current release.
- Fixed: Default Email Template for booked user emails was reset to empty on every plugin update
- Fixed: Manual bookings were refused as already booked when the admin adding them had their own booking on the event
- Fixed: Coupon list counts included coupons not visible to the current user when filtering by date
- Fixed: Renew license link in plugin update notices and the manual license key help link pointed to broken URLs
- Fixed: Custom email recipients containing an invisible tab or non-breaking space failed to save as an invalid admin email
- Fixed: Coupon start and end date fields did not work on the coupon admin screen in legacy gateways mode
- Tweaked: Removed unused development files from the bundled QR code library