Skip to content
OpenAdvisories

Vendor

imithemes

16 known vulnerabilities.

Products

Eventer - WordPress Event & Booking Manager Plugin 6 Eventer 4 Real Spaces - WordPress Properties Directory Theme 2 NativeChurch 2 IMITHEMES Listing 1 Gaea 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-39483

    WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in imithemes Eventer eventer allows Code Injection.This issue affects Eventer: from n/a through < 3.9.9.1.

    imithemes Eventer
  • Medium 4.3
    CVE-2025-39482

    WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.

    imithemes Eventer
  • Medium 4.3
    CVE-2024-11134

    Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export

    The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with …

    imithemes Eventer - WordPress Event & Booking Manager Plugin Web / CMS
  • Medium 6.4
    CVE-2024-11132

    Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentic…

    imithemes Eventer - WordPress Event & Booking Manager Plugin Web / CMS
  • Medium 5.3
    CVE-2024-11133

    Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download

    The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers t…

    imithemes Eventer - WordPress Event & Booking Manager Plugin Web / CMS
  • Medium 6.5
    CVE-2024-10799

    Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read

    The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_download_tickets() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to r…

    imithemes Eventer - WordPress Event & Booking Manager Plugin Web / CMS