Events Manager 7.4.14, Pro 3.9.10 + More!

Events Manager 7.4.14 and Events Manager Pro 3.9.10 are out, along with updates to our Stripe, PayPal and Square add-ons. There are no headline features in this one (those are coming, more on that further down). It’s a long list of bug fixes and a batch of security fixes, and the security side is the part we’d like to talk about, because something we didn’t quite expect has happened over the last few weeks.

Nearly 15 years of reports, in one month

Three weeks ago we opened the Security Hunt and invited anyone with an AI to try and break Events Manager (we explained why at the time). It has worked better than we hoped. The hunt has confirmed 28 vulnerabilities so far, from 10 different hunters, and you can see who found what on the scoreboard.

For some perspective, the WPScan database lists 31 vulnerabilities reported in Events Manager up to the end of 2025, which is roughly 15 years of public reporting. The hunt is three short of that in a single month, and we expect to pass it before it closes. (It isn’t quite a like-for-like comparison, since our 28 includes Events Manager Pro and the add-ons while the WPScan list covers the free plugin only, but it gives you an idea of the scale.)

That’s not an entirely comfortable number to publish… every one of those was a hole sitting in our code. The difference is that these were reported to us privately and fixed, rather than found the hard way on somebody’s site, and that makes Events Manager safer for everyone who runs it. That was the whole point of the hunt, so thank you to everyone who has sent a report in.

A very long changelog

We won’t walk through what’s in this release, because the changelog at the bottom of this post does a better job of that than we could here. To give you an idea of its size though, there are 124 entries across the five plugins.

Of those, 96 are bug fixes (33 in Events Manager, 22 in Pro and another 41 between the Stripe, PayPal and Square add-ons), and 16 are security fixes or hardening, with the latest batch of hunt reports among them. The security entries are deliberately short on specifics, so that everyone has time to update before the details are public.

We’re extending our discounts

A month like this one asks a fair bit of everyone who runs our plugins, with more updates to apply than usual and more on the way while the reports keep arriving. As a token of goodwill we’re extending our current discounts for as long as those reports keep coming in, which means you can still get Events Manager Pro at up to 35% off.

The hunt itself still closes as planned, so if you’ve been meaning to point your AI at our code there’s still time, and the Security Hunt page has the rules and the rewards.

New features are on the way

This release is fixes only, and that’s on purpose. We have a set of new features built and in testing, and we decided to give them a little more time rather than hold the security fixes back until they were ready.

They’re not far off though. We’re about to make some major updates to Events Manager and Pro, with an announcement or two to go with them, and we’ll share it all here on the blog and in our newsletter (more on this in the coming days!).

Updating

You can update from the Plugins screen of your WordPress dashboard. That’s Events Manager 7.4.14 and Events Manager Pro 3.9.10, plus Stripe 2.5.4, PayPal 1.4.2 and Square 1.0.1 if you use them. Given the security fixes, please update every site you run as soon as you can. Events Manager now needs PHP 7.4 or later, so if the update isn’t being offered to you, that’s the first thing to check with your host.

If anything misbehaves after updating, let us know on the support forums and we’ll take a look.

Changelog

Events Manager 7.4.14

Added: “Add Reply-To booker?” email setting so replies to admin booking emails go to the person who booked, off by default
Added: Booking Notes column for the bookings table and export
Added: Privacy Consent column for the bookings table and export, also shown in the booker details
Fixed: Events and locations being deleted instead of reassigned when deleting a user on WordPress 7.1
Fixed: [locations_map] showing no locations when a location in the results was not publicly viewable, regression in 7.4.12
Fixed: Ticket booking list being empty for admins who do not own the event
Fixed: Time slots not saving on event archetypes
Fixed: Fatal error on PHP 8 when viewing a booking with a non-numeric surcharge
Fixed: next-month and x-months scopes returning the wrong range on the 29th to 31st of a month
Fixed: Calendar location attribute being lost when navigating between months
Fixed: Registration email templates being hidden when the registration email is enabled
Fixed: PHP warning when reading an event’s created or modified date
Fixed: Edit and delete links for repeating events pointing nowhere when repeating events are disabled
Fixed: PHP 8.4 deprecation notices in the phone number library
Fixed: Updating an event through the REST API or MCP added a free bookable ticket to it
Fixed: Event updates through the REST API or MCP added a new ticket instead of updating the one sent under its ticket ID
Fixed: Tickets created through the REST API or MCP without a status could not be booked, and updates without a status disabled them
Fixed: Time changes to existing events through the REST API or MCP reported success without being saved
Fixed: Updating a booking’s payment gateway through the REST API or MCP reported success without changing it, it is now refused
Fixed: Booking updates through the REST API or MCP that resent the booking’s gateway reset its status with older Events Manager Pro versions
Fixed: Repeating events created through the REST API or MCP losing ticket availability dates and tags on their recurrences
Fixed: Ticket changes on an existing repeating event through the REST API or MCP not reaching its recurrences
Fixed: New recurring events copying only their last ticket to each recurrence
Fixed: Recurrences of recurring events not matching category and tag filters, including category and tag pages
Fixed: Rescheduling a timeslotted event cancelling the whole event and its bookings instead of only the removed time slots
Fixed: Duplicated events keeping the original’s booking cut-off date, which could close bookings on the copy straight away
Fixed: Submitting the booking form again while it is still sending creating duplicate bookings when JavaScript is unavailable
Fixed: {is_user_attendee} and {not_user_attendee} conditional placeholders never matching when given several booking statuses
Fixed: Personal data export failing with a fatal error on bookings made without a user account
Fixed: Consent given on event and location submission forms not being recorded, and communications consent being removed on front-end saves
Fixed: Blank location details in emails about events submitted by guests with a new location
Fixed: Front-end location editor being blocked by security plugins due to mismatched action parameters
Fixed: MS Global subsite event and location links that match nothing showing a blank item instead of a 404
Fixed: Warning notices displaying in the default notice colors
Fixed: OAuth integration settings such as Zoom displaying without their settings box
Fixed: Events Manager Connect 1.0.1 not receiving plugin updates
Tweaked: Removed a duplicate recurrence save during quick edit
Tweaked: Paginated location searches no longer use the deprecated SQL_CALC_FOUND_ROWS, added the em_locations_get_sql_count filter
Tweaked: Removed the unimplemented events/validate endpoint from the REST API docs
Security: Fixed a privilege escalation vulnerability in bookings, reported by mercurystorm via the Security Hunt
Security: Fixed an access control vulnerability affecting bookings on private events, reported by elaprendiz1927 via the Security Hunt
Security: Fixed access control and information disclosure vulnerabilities in the bookings REST API, reported by mercurystorm via the Security Hunt
Security: Fixed an access control vulnerability affecting media uploads in the REST API, reported by mercurystorm via the Security Hunt
Security: Fixed a low severity content restriction bypass on event previews, reported by Jon Eiseman via the Security Hunt
Security: Fixed a medium severity REST API moderation bypass, reported by Scott Lewis via the Security Hunt
Security: Fixed a medium severity information disclosure vulnerability in the abilities API, reported by Scott Lewis via the Security Hunt

Events Manager Pro 3.9.10

Added: emp_transaction_data and emp_transaction_recorded hooks around every recorded transaction
Security: Hardened payment cancellation and capture requests
Security: Fixed an access control vulnerability in the bookings REST API, reported by mercurystorm via the Security Hunt
Tweaked: “Reserved unconfirmed spaces?” setting is now only shown for gateways it applies to
Tweaked: The transactions table now accepts gateway transaction IDs of up to 255 characters and is prepared for upcoming payment features, it is updated once when you update
Tweaked: Transaction amounts in personal data exports are formatted in their currency
Tweaked: Older Stripe, PayPal and Square add-on versions keep their previous handling of unpaid and cancelled payments until they are updated
Fixed: Multiple Booking invoices showing an empty or incorrect date
Fixed: Custom Automated Emails not collapsing in the block editor, which let edits be made to emails set to default that were then not saved
Fixed: Stray whitespace in the waitlist fields when editing an event
Fixed: Creating or updating a coupon through the REST API or MCP rejected its documented fields
Fixed: Updating a coupon through the REST API or MCP caused a fatal error when legacy gateways are enabled
Fixed: Coupons missing from some recurrences after extending a recurring event’s dates
Fixed: No way to remove a coupon once applied in the Multiple Bookings cart
Fixed: Event and booking transaction tables empty or missing payments in Multiple Bookings mode
Fixed: Disputed payments added to the amount paid instead of subtracted
Fixed: Approving a part-paid offline booking recorded the full price again
Fixed: Approving a Multiple Bookings cart recorded payments again for bookings already paid within it
Fixed: Manual booking part payments saved with an incorrectly formatted amount
Fixed: JavaScript error when a payment gateway validates the booking form asynchronously
Fixed: Duplicate transactions when two payment notifications for one booking arrived at once, or on multisite sub-sites
Fixed: Bookings with recorded payments deleted when a payment attempt was cancelled or expired
Fixed: Unpaid bookings expired just after a payment arrived for them
Fixed: Unpaid bookings never expiring when a gateway’s expired booking action was never saved
Fixed: Abandoned online payments not removed for customers, holding their spaces and blocking a new booking until they expired
Fixed: Manual bookings deleted when their online payment expired, they are now cancelled
Fixed: Payments captured, cancelled or expired in the site’s test or live mode instead of the mode the booking was made in
Fixed: Updating a booking through the REST API or MCP with a gateway reset its status and gateway
Fixed: Legacy gateways mode could delete a booking made with another gateway, or a cart holding a paid booking

Stripe 2.5.4

Security: Fixed an access control vulnerability in payment returns
Security: Hardened payment cancellation requests
Fixed: Stripe Elements card fields not loading in test mode, regression in 2.5.2
Fixed: Stripe Elements amount not updating when a booking changes, regression in 2.5.3
Fixed: Stripe Elements theme and layout settings being ignored
Fixed: Payment description showing a 1970 date for bookings across multiple events
Fixed: Payments that were already disputed approved the booking instead of cancelling it
Fixed: Refunds recorded more than once, and fully refunded bookings left pending
Fixed: Refunds and disputes recorded twice when both Stripe webhooks are set up
Fixed: Disputes recorded as positive amounts
Fixed: Refunds that later failed still counted as refunded
Fixed: Duplicate payments recorded when a webhook and the return page arrived at the same time
Fixed: Unpaid Stripe Checkout bookings with a declined card never expiring
Fixed: Declined or abandoned payment attempts left behind as bookings awaiting payment
Fixed: A Stripe Elements payment could be taken for a booking the site could not match, when updating the payment failed
Fixed: An error preparing a Stripe Checkout session left the booking behind awaiting payment
Fixed: Multiple Bookings cart not given back after a failed Stripe payment on older Events Manager Pro versions
Fixed: My Bookings page error when a Stripe Checkout payment could not be resumed

PayPal 1.4.2

Security: Fixed a payment validation vulnerability
Security: Hardened webhook verification
Security: Hardened payment cancellation and capture requests
Tweaked: Admins are asked to save the PayPal settings once after updating, so PayPal sends the new payment notifications
Fixed: PayPal Advanced card fields not rendering on events with time ranges
Fixed: Pending and declined PayPal payments, such as eChecks, recorded as paid and approving the booking
Fixed: Pending PayPal payments never confirmed or cancelled once PayPal settled them
Fixed: Orders rejected by PayPal for tickets with more than one space
Fixed: PayPal disputes not recorded
Fixed: Partial refunds adding up to the full amount not cancelling the booking
Fixed: Refunds and disputes recorded twice when PayPal notifications arrived at the same time
Fixed: Unpaid PayPal Advanced bookings expired without checking PayPal for a payment
Fixed: Unpaid bookings never expiring when the expired booking action was never saved
Fixed: Declined or abandoned PayPal payments left behind as bookings awaiting payment, or as cancelled bookings
Fixed: Buyers shown PayPal’s raw error text when a payment was declined or failed
Fixed: Every PayPal request fetching a new access token instead of reusing the stored one
Fixed: Multiple Bookings cart not given back after a declined PayPal payment

Square 1.0.1

Security: Fixed an access control vulnerability in payment returns
Security: Hardened payment and cancellation requests
Fixed: Square refunds never recorded, so the amount paid ignored them
Fixed: A late declined-card notice cancelling a booking another card had paid for
Fixed: Each update to a Square dispute recorded it again and cancelled the booking again
Fixed: Unpaid bookings expired just after a payment arrived for them
Fixed: Unpaid bookings never expiring when the expired booking action was never saved
Fixed: Square Web bookings using the Square Checkout expiry setting
Fixed: Unpaid bookings deleted when Square could not be reached to confirm their payment
Fixed: Square Checkout payment links still payable after their booking was cancelled on expiry
Fixed: Declined or abandoned Square Web payments left behind as bookings awaiting payment, or as cancelled bookings
Fixed: Square Web bookings left awaiting payment when Square rejected the charge itself, such as for an unsupported currency
Fixed: A new Square customer created for every payment instead of reusing the existing one
Fixed: Square Web charges and unpaid booking checks using the site’s test or live credentials instead of the booking’s

Blog