The hunt has turned up 13 more confirmed issues since our last update, and these releases fix all of them. We’re keeping the details brief until sites have had time to update. If your Pro license has expired, free patches for older versions are on your security updates page, as they were last time.

You can see who’s in the lead on the scoreboard. The hunt runs until November 30, and whoever tops the board then wins a lifetime Pro license.

Our thanks to Greg on 30A, mercurystorm, HMF-IT, Benjamin Kincses and Waldo.

Changelog

Events Manager 7.4.13

• Security: Fixed a file handling vulnerability in the REST API, reported by Greg on 30A via the Security Hunt
• Security: Fixed an information disclosure vulnerability in the REST API, reported by Greg on 30A via the Security Hunt
• Security: Fixed an access control vulnerability affecting tickets, reported by Greg on 30A via the Security Hunt
• Security: Fixed an access control vulnerability in bookings, reported by mercurystorm via the Security Hunt
• Security: Fixed an information disclosure vulnerability affecting locations, reported by Benjamin Kincses via the Security Hunt
• Security: Fixed an information disclosure vulnerability in shortcodes, reported by mercurystorm via the Security Hunt
• Security: Fixed a vulnerability in booking withdrawals, reported by mercurystorm via the Security Hunt
• Security: Hardened remote image downloads in the REST API

Events Manager Pro 3.9.9

• Security: Fixed an information disclosure vulnerability in manual bookings, reported by HMF-IT via the Security Hunt
• Security: Fixed an access control vulnerability in waitlists, reported by HMF-IT via the Security Hunt
• Security: Fixed an XSS vulnerability in the admin area, reported by HMF-IT via the Security Hunt
• Security: Fixed an information disclosure vulnerability affecting locations, reported by HMF-IT via the Security Hunt
• Security: Hardened coupon handling at checkout
• Tweaked: Failed reCAPTCHA log entries no longer record the submitted form data
• Fixed: The release package left out the updated Dompdf library added in 3.9.6, so 3.9.6 to 3.9.8 downloads were rebuilt with it

Events Manager Pro Stripe Gateway 2.5.3

• Security: Fixed a payment validation vulnerability, reported by mercurystorm via the Security Hunt

The post Security Update: Events Manager 7.4.13, Pro 3.9.9 and Stripe 2.5.3 appeared first on Events Manager for WordPress.

Yesterday’s 7.4.11 closed an unauthenticated information disclosure, and as we released a separate hunter found a related path it did not cover. 7.4.12 closes it on both of those endpoints.

That is the hunt working as intended, a second pair of eyes catching what our first fix missed, privately and before anyone else. The Security Hunt runs until November 30, the scoreboard goes live in the coming days, and there is a lifetime Pro license for whoever tops it.

Our thanks to 0xtrung.

Changelog

Events Manager 7.4.12

• Security: Fixed an unauthenticated information disclosure where the map data endpoints could expose details of draft, pending and private locations, reported by 0xtrung via the Security Hunt

The post Security Update: Events Manager 7.4.12 appeared first on Events Manager for WordPress.

The Stripe one matters most: a single paid Stripe PaymentIntent could approve more than one booking. If you take payments through the Stripe Elements gateway, update to Events Manager Pro – Stripe 2.5.2. Events Manager – Connect 1.0.1 hardens how its WhatsApp and Telegram webhooks check their secrets.

Changelog

Events Manager Pro – Stripe 2.5.2

• Security: Fixed a payment bypass where one paid Stripe PaymentIntent could approve additional bookings, reported by mercurystorm via the Security Hunt
• Fixed: The Elements test publishable key was read from the wrong variable when localizing the payment script (props Will Pom)

Events Manager – Connect 1.0.1

• Security: Hardened webhook secret handling for the WhatsApp and Telegram integrations, rejecting blank or forged secrets and using constant-time comparison, reported by Will Pom via the Security Hunt

The post Add-on Security Updates: Stripe 2.5.2 and Connect 1.0.1 appeared first on Events Manager for WordPress.

Last week we opened the Security Hunt, asking you to point your own AI at Events Manager and report what it finds before anyone else does. It is working: in the first few days, three people reported nine security issues across Events Manager, Pro and two add-ons, all reproduced and fixed before any detail went public. We have held the specifics back for now so sites can update first.

We will post the scoreboard in the coming days. The hunt runs until November 30, with a lifetime Pro license for whoever tops it, and there is still plenty to find. If you want in, the rules and the AI prompts are on the hunt page.

Changelog

Events Manager 7.4.11

• Security: Fixed an unauthenticated information disclosure vulnerability that could expose event owner details, reported by mercurystorm via the Security Hunt
• Security: File upload display names are now stored as plain text, reported by mercurystorm via the Security Hunt
• Security: Fixed an unauthenticated information disclosure where request status parameters could expose draft, pending and trashed events and locations, reported by Lewis Studios via the Security Hunt
• Security: Fixed a booking takeover where a contributor or author could re-save another user’s booking onto an event they own, exposing that booker’s details, reported by Lewis Studios via the Security Hunt
• Security: An OAuth connection limited to Events Manager is now refused over XML-RPC instead of acting with the account’s full access, reported by Will Pom via the Security Hunt

Events Manager Pro 3.9.8

• Security: Fixed an unauthenticated stored cross-site scripting vulnerability in booking form file uploads, reported by mercurystorm via the Security Hunt
• Security: The coupon check endpoint now requires the booking form nonce, so coupon codes can no longer be brute-forced anonymously, reported by Will Pom via the Security Hunt

The post Security Update: Events Manager 7.4.11 and Pro 3.9.8 appeared first on Events Manager for WordPress.

We’ve decided to do something a little out there…

Everyone has an AI that can read code now (among other dangerous things), and plenty of people are pointing theirs at WordPress plugins, ours very much included. So we’re making it official. From today until November 30, we want you to point yours at Events Manager and try to break it.

Find a real security vulnerability, report it to us privately, and we’ll put your name on the scoreboard, pay you in Events Manager Pro license time, and fix it before anyone else gets the chance. Whoever is top of the scoreboard on November 30 wins a lifetime Events Manager Pro license.

Join the hunt at wp-events-plugin.com/security

Why we’re asking for it

Security reports have been arriving faster this year than at any point in the plugin’s history. We’re not the only ones; WordPress itself has introduced its own countermeasures to combat this new phenomenon.

Some come out of our own AI-assisted reviews, and many come from researchers using the same kind of tools, who report through Patchstack, Wordfence and similar programs. Those programs do good work and we’re grateful for every report, but they reach us on someone else’s timeline, and now and then an issue gets flagged publicly before we have a fix out. The race condition fixed in 7.4.9 was one of those.

The best report we’ve had this year didn’t come through any of them. It came from a customer, who ran his own AI review of the plugin and sent what he found straight to us which ended up as the 7.4.8 update. That’s the kind of report we want more of, from people who actually run Events Manager and have every reason to want it locked down.

We’re not scared of what you’ll find. We don’t want someone else finding it first and exploiting it. So we’re opening the doors of Pandora’s box.

How it works

1. Set your AI loose. Any AI tool you like. Events Manager is on wordpress.org, and Pro license holders can download Pro and the add-ons from their account. The hunt page has a starter prompt if you want one.
2. Prove it’s real. Make it happen on a clean install of the latest version, on a site you own. AI tools cry wolf a lot (we’ve waded through plenty of those ourselves), and we only score what actually works.
3. Paste the write-up. The hunt page also has a report prompt that gets your AI to write the finding up in the format we triage from. Paste what it writes into the form and you’re on the board. No account needed, just your email.

What’s on the table

Pro time goes onto the license for your email, or a new license if you don’t have one, up to 24 months per person. The lifetime license for whoever finishes on top is on top of that, and if two people tie, it goes to whoever got there first.

For more information on the rules and how to submit, visit our new security hunt page.

The sale is back too

7.4.9 was a security release and we want as many sites as possible on current versions, so our recent sale is back for the meantime: up to 35% off Events Manager Pro on new licenses, upgrades and renewals, including renewing early. An active license is also what gets you Pro’s own security fixes, so if yours has lapsed, now is a good time to renew.

Happy hunting… and if you’d rather keep reporting the way you do now, security@wp-events-plugin.com still works.

The post Break Events Manager – We want YOUR AI appeared first on Events Manager for WordPress.

We apologize for the repeated warnings and what may feel like a new security update every other day. With AI tooling now in everyone’s hands, and our code being open source, the plugin is being scrutinized more closely than ever before. We welcome it, and hope that every one of these updates leaves us stronger.

This one is a case in point. It came from a customer, Alexander Ströher, who ran his own AI-assisted review of the plugin and disclosed what he found directly to us, responsibly. He is credited in the changelogs below, and we’d like to thank him for the contribution.

On that note, anyone is welcome to have a go and see what they find. Email us at security@wp-events-plugin.com. This is an experiment in the open, and we’re curious to see where it leads.

If you run an older Pro version and can’t update to 3.9.6 yet, patched builds for the 2.8 and 3.0 to 3.8 lines are available from your account downloads, alongside the ones released in August.

Events Manager 7.4.8

• Security: Fixed a clickjacking vulnerability and restricted the permissions granted to AI/MCP connections. Reported by Alexander Ströher.
• Security: Fixed a cross-site scripting vulnerability. Reported by Alexander Ströher.
• Security: Fixed an information disclosure vulnerability in the REST API. Reported by Alexander Ströher.
• Security: Additional hardening of the OAuth endpoints, uploads and search parameters.
• Fixed: Calendars with long_events enabled hid timed events on the last displayed day of the grid
• Fixed: Location searches with array coordinates, country-name lookups and timezone-scoped date ranges returned wrong results
• Fixed: REST API events and bookings endpoints returned an error for some search parameters
• Fixed: Missing text domain in the general settings tab

Events Manager Pro 3.9.6

• Security: Fixed an authenticated SQL injection vulnerability. Reported by Alexander Ströher.
• Security: Fixed a cross-site scripting vulnerability in the admin area. Reported by Alexander Ströher.
• Security: Additional hardening of file downloads, the uploads directory and legacy gateway code.
• Security: Updated the bundled PDF library to its current release.
• Fixed: Default Email Template for booked user emails was reset to empty on every plugin update
• Fixed: Manual bookings were refused as already booked when the admin adding them had their own booking on the event
• Fixed: Coupon list counts included coupons not visible to the current user when filtering by date
• Fixed: Renew license link in plugin update notices and the manual license key help link pointed to broken URLs
• Fixed: Custom email recipients containing an invisible tab or non-breaking space failed to save as an invalid admin email
• Fixed: Coupon start and end date fields did not work on the coupon admin screen in legacy gateways mode
• Tweaked: Removed unused development files from the bundled QR code library

The post Another Security Update – 7.4.8 / 3.9.6 appeared first on Events Manager for WordPress.

What happened

The flaw sat in some older code that validates the dates of an event search. That code wasn’t reachable in a harmful way through the regular front-end search, but the REST API we introduced in 7.3 passes search parameters along differently, which let a specially crafted request get past the validation and into a database query.

Exploiting it requires being logged in, although any account will do, right down to a basic Subscriber.

What to do

Update Events Manager to 7.4.7. That closes the vulnerability on its own, whichever version of Events Manager Pro you’re running (or if you don’t use Pro at all).

At the time of writing, 7.4.7 is sitting in a roughly 5-hour queue before WordPress.org offers it to sites, as part of the Protect The Shire initiative, which holds every new plugin release for a few hours, security fixes included. We’ve asked the Plugins team to speed this one up, but you don’t have to wait for them. Follow our instructions to getting the latest stable update (whicn you can enable automatically) via our settings page, or update to a dev version, which is also on 7.4.7.

On older versions that option isn’t available yet… instead, download the 7.4.7 zip from the plugin page and upload it from the Plugins screen (Add New, then Upload Plugin), which replaces your installed copy.

If you use Pro, please also update to Pro 3.9.5. Pro’s own REST API, added in 3.8.1, offered a second route to the same flaw for users who can manage bookings. Events Manager 7.4.7 already closes that route, and Pro 3.9.5 hardens Pro’s code as well, so it no longer relies on the core fix alone.

Credit for the discovery goes to neurotx, who disclosed it via Patchstack.

More eyes, stronger plugin

We’ve put Events Manager through several AI-assisted security audits this year, which turned up and fixed a number of issues, and this one still slipped past every pass. It goes to show that different researchers using different tools will sometimes uncover what everyone else missed. It’s regrettable that older code was the source of this one, and we’re sorry for the hassle of an urgent update… but we also appreciate having so many eyes on an open source plugin like this. That attention is what lets us put Events Manager through the gauntlet of rigorous security testing and harden it properly, and the result is a stronger plugin for everyone. We’re all for it.

On a ligter note

We’ve brought back our recent Pro promotion for a little longer, as a thank you to everyone who has stuck with us and anyone joining now. It’s entirely separate from this fix, which is free for everyone in Events Manager 7.4.7, whether or not you use Pro.

Changelog

Events Manager 7.4.7

• Security: Fixed an authenticated SQL injection vulnerability in the REST API events and bookings search, disclosed by neurotx via Patchstack.

Events Manager Pro 3.9.5

• Security: Hardened the coupons date-scope search against SQL injection, scope dates are now validated before use.
• Fixed: Timeslot bookings in the Multiple Bookings cart could not show their details or be removed, the cart script did not escape the event:timeslot id in its selectors

The post Important Security Update – 7.4.7 appeared first on Events Manager for WordPress.

Events Manager 7.4.6

• Fixed: fatal error on tag pages, and in the admin area after updating, when an event type had no categories or tags enabled
• Fixed: tag pages skipped upcoming events for event types with tags but no categories
• Fixed: login failing on sites with a custom event type while debug output was displayed, a notice was printed before headers were sent
• Fixed: bookings tables on WordPress 7.1 repeated every row’s details on wide screens and could not expand rows on narrow ones
• Fixed: database errors on subsites in MultiSite Global Tables mode, event time ranges and timeslots were looked up in per-site tables that were never created and are now shared like other event data

Events Manager Pro 3.9.4

• Fixed: Joining a waiting list failing with an “Unrecognized action” message on cached sites, the form’s security token is now refreshed and an expired one is reported plainly
• Fixed: Spaces for a booking awaiting payment counted twice, which could show an event as full before it was
• Fixed: Bookings awaiting payment holding their spaces indefinitely when no unpaid booking expiry was set, spaces are now held only while an expiry can release them
• Fixed: Past Events Action cron running until the PHP time limit every minute when an event could not be moved, which always happened with the Trash action
• Fixed: Past Events Action trashing or hiding a whole recurring event with upcoming dates once one of its dates had passed
• Fixed: PayPal Standard refusing any booking with a coupon or surcharge applied, the cart item was sent without its quantity and PayPal answered with a generic error page
• Fixed: A booking discounted to zero still offering a PayPal payment link on My Bookings
• Fixed: The event editor telling owners “No coupons created yet” when their coupons are all set to apply site-wide or event-wide
• Fixed: PayPal Standard payments rejected with a merchant email mismatch when the PayPal Email setting is a secondary address of the PayPal account
• Changed: Bookings cancelled by Unpaid Bookings Expiry no longer send cancellation emails, an abandoned payment attempt now expires silently
• Fixed: Event image missing from PDF tickets, which also pushed the QR code off the page

The post Events Manager 7.4.6 and Pro 3.9.4 appeared first on Events Manager for WordPress.

Between the two core releases we’ve patched up a few more security vulnerabilities. All of them were responsibly disclosed and all of them were fixed and shipped before this post went live. Our thanks to the researchers who found them, and to Patchstack, Wordfence and WPScan for getting them to us.

We’ve got some exciting things in the pipeline, and we’ll have more to say about those when they’re ready to show. In the meantime we’ve been using these releases to close out long-standing bugs, including a few that have been on our list longer than we’d like.

So the rest is bug fixing, and there’s a good amount of it: bookings on cached sites, recurring events and their occurrences, a scattering of admin and block editor annoyances. Pro’s two releases lean toward waiting lists and payments, with a few PDF and email fixes alongside.

Full changelogs below.

Events Manager 7.4.4 and 7.4.5

• Security: Fixed a broken access control vulnerability. Reported by Hasyros via WPScan.
• Security: Fixed an information disclosure vulnerability. Reported by Karthik Ramakrishnan via WPScan.
• Security: Fixed an information disclosure vulnerability. Reported via Patchstack.
• Security: Fixed a missing authorization vulnerability, CVE-2026-92711. Reported by M4r0u4n3 via Wordfence.
• Security: Fixed a spoofing vulnerability, CVE-2026-92614. Reported by Shirshak via Wordfence.
• Added: em_get_my_bookings_url() accepts a person id and runs through the em_get_my_bookings_url filter, so BuddyPress links resolve the booking owner rather than the displayed user
• Changed: the admin bookings list and pending badge now show only the event type you are viewing, with an All Event Types filter for the combined list
• Fixed: newly booked attendees did not show on the event page until caches were flushed on sites with a persistent object cache, the event was cached with an emptied bookings list and never invalidated when bookings changed
• Fixed: booking submissions on cached sites failed with “unexpected network error” once the form’s security token expired, the form now says it expired and should be reloaded
• Fixed: the booking form security token was only refreshed for the standard booking form on cached sites
• Fixed: deleting a recurring event’s bookings reported success without deleting anything
• Fixed: repeating event occurrences had every previous occurrence’s date appended to their slug, breaking their URLs
• Fixed: the waiting list could not be joined for a fully booked occurrence of a recurring event
• Fixed: the pending spaces count ignored a forced refresh and could stay stale after a booking
• Fixed: events with an emoji in their name or content could not be saved on older database tables
• Fixed: events created by imports or the REST API were missing from listings until re-saved because their type and archetype were never set, existing events are repaired on upgrade
• Fixed: events using a custom archetype could not be edited, reporting “Sorry, you are not allowed to edit this post”
• Fixed: publishing an event in the block editor saved it as a draft when pre-publish checks were disabled
• Fixed: an end time earlier than the start time was not flagged while editing an event
• Fixed: an event ending after midnight on a later day was flagged as ending before it started
• Fixed: calendar date previews still rendered their modals when Date Preview Mode was set to Direct Link
• Fixed: the day view of the events page could not be paginated
• Fixed: the events search form could submit to the default language events page under WPML, and to the wrong page on themes overriding the search template
• Fixed: an empty events page setting could write a rewrite rule that broke the page being viewed until rewrite rules regenerated
• Fixed: fatal error on the category page after updating when an archetype has both categories and tags disabled
• Fixed: fatal error on first activation from WP-CLI or other non-admin contexts because the admin notice class was not loaded
• Fixed: scheduled imports failed because wp-cron and WP-CLI requests were subject to the public submitter consent check
• Fixed: the booking meta migration from 6.1 could rerun on every page load when a batch of bookings had no meta, slowing or crashing the site after an upgrade
• Fixed: bookings with a zero booking date in the database displayed as “November 29, -0001”
• Fixed: bulk actions such as Move to Trash in the admin failed to redirect due to a warning from the archetype post type check
• Fixed: deleting a booking from the admin bookings table still rendered its row actions and could print a warning into the response
• Fixed: admin booking tables could stop responding when the export or settings form was picked up before the main table form, notably on multisite
• Fixed: the booking submit button read “null” after an AJAX submission
• Fixed: radio buttons were invisible on the admin Add Booking form due to checkbox styling applied to radios
• Fixed: the edit icon in the admin bookings list spilled out of its column on narrow screens
• Fixed: a PHP warning was printed above the header row of CSV booking exports
• Fixed: a PHP deprecation notice was printed on the admin bookings pages when debugging was enabled
• Fixed: uninstalling from a sub-site in MS Global mode dropped the shared network event and booking tables, it is now refused with a link to the network settings
• Fixed: the bookings admin page turned the URL action into a booking lifecycle hook name, so listeners of em_bookings_add could fatal, a dedicated em_bookings_admin_action_* hook now fires alongside the legacy name
• Fixed: the REST API bookings list only returned bookings on the caller’s own events, even for users who can manage all bookings
• Fixed: the Test Email Settings button reported “Server Error” for administrators without the activate_plugins capability
• Fixed: EM_Event::set_timeslot_id() could never load a timeslot due to malformed SQL
• Tweaked: typo on the help page

Events Manager Pro 3.9.2 and 3.9.3

• Fixed: Quick Pay bookings were always created as Offline when more than one payment button was shown, breaking PayPal checkout
• Fixed: Unpaid bookings never expiring when only a payment method’s own Unpaid Bookings Expiry was set, and expiring after one minute when the expiry did run
• Fixed: Bookings awaiting payment holding their spaces indefinitely when no unpaid booking expiry was set, spaces are now held only while an expiry can release them
• Fixed: Spaces for a booking awaiting payment counted twice, which could show an event as full before it was
• Fixed: Payment method buttons rendering blank when their label setting had been saved empty, the payment method name is used again
• Fixed: Manual booking Amount Paid field defaulting to whitespace, causing an “Invalid payment amount” error
• Fixed: Waiting list unreachable on a fully booked occurrence of a recurring event, the signup form is now offered on the occurrence being viewed
• Fixed: Joining a waiting list failing with an “Unrecognized action” message on cached sites, the form’s security token is now refreshed and an expired one is reported plainly
• Fixed: Approving a waiting list booking could leave the booking form missing, log a temp_event_rsvp_spaces warning and release the held space to someone else
• Fixed: Waiting list approval emails could link to another member’s bookings page on BuddyPress sites
• Fixed: Booking reminders queued again every minute and sent repeatedly, the cron guard never matched its own schedule and nothing recorded a reminder as sent
• Fixed: Send Emails recipient estimate and send skipping waiting list bookings, which carry no ticket type
• Fixed: Ticket scanning and the frontend bookings manager returning a 404 until permalinks were re-saved, the endpoint now registers itself when the feature is enabled
• Fixed: Logo missing from PDF tickets and invoices, rendered as “Image not found” because the PDF renderer could not load it
• Fixed: Malformed title tag in the booking PDF template, which left the generated PDF with no document title
• Fixed: Booking form fields marked required blocking user profile saves in wp-admin
• Fixed: Attendee migration failing with a SQL error on legacy meta keys, leaving attendee data unmigrated
• Fixed: Typos in the waiting list and past events settings descriptions

Thanks, as always, for trusting us with your events, your attendees and their data.

The post Events Manager 7.4.5 and Pro 3.9.3 appeared first on Events Manager for WordPress.

It is reflected XSS, not stored, and the difference matters more than it might sound. This release
also clears up some confusion around 7.4.2, and we would rather explain it than leave it sitting there.

Reflected, not stored

Some trackers that relayed Patchstack’s report list this as stored XSS. It is reflected, and if you
have been trying to work out your exposure that distinction is the whole question.

A stored issue means something malicious is already sitting in your database, running for anyone who
loads the page. A reflected one never touches your site’s data. It only fires for someone who follows
a crafted link, and it does nothing until they do. Sites listed as carrying a stored vulnerability
went looking for planted payloads that were never going to be there.

What we thought, and what it actually was

The report surfaced shortly after 7.4.1, which carried a batch of significant security fixes. Looking
for it, we found an unfiltered variable that looked like it belonged to the same family, and it seemed
reasonable that the report had come out of a rescan following that release.

So we fixed what we found in 7.4.2, and attached a “possibly” to the changelog because we could not
confirm it.

• Fixed in 7.4.2, self-diagnosed: an unfiltered variable found in our own review. Real, and worth
  fixing. Not the reported one.
• Fixed in 7.4.3, CVE-2026-66457: reflected XSS via list formatting parameters. The reported
  vulnerability, in a different part of the code. Still live on 7.4.2.

It turned out to be a different issue in a different part of the code, so 7.4.2 did not fix what
people believed it fixed. If you are running it, please update.

A recipe for confusion

Over the past few months we have patched close to forty security vulnerabilities across the Events
Manager family. Most we identified ourselves through the internal review programme we wrote about in July rather than having them reported to us, and a number of those were then reported by researchers after we had already shipped the fix.

Those fixes do not update uniformly across the vulnerability databases. Issues we resolved some time ago are still listed as open in one channel and patched in another, and the versions each one names do not always agree.

Two of those earlier updates included reflected XSS fixes of their own. By the time this report appeared there were already several similar-sounding entries in circulation, at different stages of being marked fixed, naming different versions.

Add a notification that never reached us, and it was a recipe for confusion. We do not blame anyone
for being unsure whether they were exposed, or on which version.

Why this took us longer than usual

That notification normally gives us the details and a window to patch before anything is published. Without it, the report went public while we were still in the dark about what it described, which left us knowing a vulnerability existed in our plugin without being able to see what it was.

So we approached Patchstack directly and asked. They worked with us to give us access to the report,
and we are grateful for that. Once we had it in hand we reproduced the issue, confirmed it was live on
7.4.2, wrote the fix and tested it.

7.4.3 changelog

• Security: Fixed an XSS vulnerability CVE-2026-66457. Reported by Mukhlis Amien via Patchstack.
• Security: Fixed low-severity (self-diagnosed) vulnerability allowing unfiltered shortcode output
  under specific setup/variable circumstances.
• Fixed: fatal error when the booking cancellation cut-off is set as an interval such as P2D rather
  than a number of hours
• Fixed: fatal error saving a location with an attribute no longer in your configured attribute list
• Fixed: quotes in a custom calendar month format broke the month picker
• Tweaked: documentation links now use https

With thanks to Patchstack for working with us to get us the detail we needed.

If you run Events Manager, the most useful thing you can do today is update. Thank you for trusting us
with your events, your attendees and their data.

The post EM 7.4.3 Security Update appeared first on Events Manager for WordPress.