We apologize for the repeated warnings and what may feel like a new security update every other day. With AI tooling now in everyone’s hands, and our code being open source, the plugin is being scrutinized more closely than ever before. We welcome it, and hope that every one of these updates leaves us stronger.

This one is a case in point. It came from a customer, Alexander Ströher, who ran his own AI-assisted review of the plugin and disclosed what he found directly to us, responsibly. He is credited in the changelogs below, and we’d like to thank him for the contribution.

On that note, anyone is welcome to have a go and see what they find. Email us at security@wp-events-plugin.com. This is an experiment in the open, and we’re curious to see where it leads.

If you run an older Pro version and can’t update to 3.9.6 yet, patched builds for the 2.8 and 3.0 to 3.8 lines are available from your account downloads, alongside the ones released in August.

Events Manager 7.4.8

• Security: Fixed a clickjacking vulnerability and restricted the permissions granted to AI/MCP connections. Reported by Alexander Ströher.
• Security: Fixed a cross-site scripting vulnerability. Reported by Alexander Ströher.
• Security: Fixed an information disclosure vulnerability in the REST API. Reported by Alexander Ströher.
• Security: Additional hardening of the OAuth endpoints, uploads and search parameters.
• Fixed: Calendars with long_events enabled hid timed events on the last displayed day of the grid
• Fixed: Location searches with array coordinates, country-name lookups and timezone-scoped date ranges returned wrong results
• Fixed: REST API events and bookings endpoints returned an error for some search parameters
• Fixed: Missing text domain in the general settings tab

Events Manager Pro 3.9.6

• Security: Fixed an authenticated SQL injection vulnerability. Reported by Alexander Ströher.
• Security: Fixed a cross-site scripting vulnerability in the admin area. Reported by Alexander Ströher.
• Security: Additional hardening of file downloads, the uploads directory and legacy gateway code.
• Security: Updated the bundled PDF library to its current release.
• Fixed: Default Email Template for booked user emails was reset to empty on every plugin update
• Fixed: Manual bookings were refused as already booked when the admin adding them had their own booking on the event
• Fixed: Coupon list counts included coupons not visible to the current user when filtering by date
• Fixed: Renew license link in plugin update notices and the manual license key help link pointed to broken URLs
• Fixed: Custom email recipients containing an invisible tab or non-breaking space failed to save as an invalid admin email
• Fixed: Coupon start and end date fields did not work on the coupon admin screen in legacy gateways mode
• Tweaked: Removed unused development files from the bundled QR code library

The post Another Security Update – 7.4.8 / 3.9.6 appeared first on Events Manager for WordPress.

What happened

The flaw sat in some older code that validates the dates of an event search. That code wasn’t reachable in a harmful way through the regular front-end search, but the REST API we introduced in 7.3 passes search parameters along differently, which let a specially crafted request get past the validation and into a database query.

Exploiting it requires being logged in, although any account will do, right down to a basic Subscriber.

What to do

Update Events Manager to 7.4.7. That closes the vulnerability on its own, whichever version of Events Manager Pro you’re running (or if you don’t use Pro at all).

At the time of writing, 7.4.7 is sitting in a roughly 5-hour queue before WordPress.org offers it to sites, as part of the Protect The Shire initiative, which holds every new plugin release for a few hours, security fixes included. We’ve asked the Plugins team to speed this one up, but you don’t have to wait for them. Follow our instructions to getting the latest stable update (whicn you can enable automatically) via our settings page, or update to a dev version, which is also on 7.4.7.

On older versions that option isn’t available yet… instead, download the 7.4.7 zip from the plugin page and upload it from the Plugins screen (Add New, then Upload Plugin), which replaces your installed copy.

If you use Pro, please also update to Pro 3.9.5. Pro’s own REST API, added in 3.8.1, offered a second route to the same flaw for users who can manage bookings. Events Manager 7.4.7 already closes that route, and Pro 3.9.5 hardens Pro’s code as well, so it no longer relies on the core fix alone.

Credit for the discovery goes to neurotx, who disclosed it via Patchstack.

More eyes, stronger plugin

We’ve put Events Manager through several AI-assisted security audits this year, which turned up and fixed a number of issues, and this one still slipped past every pass. It goes to show that different researchers using different tools will sometimes uncover what everyone else missed. It’s regrettable that older code was the source of this one, and we’re sorry for the hassle of an urgent update… but we also appreciate having so many eyes on an open source plugin like this. That attention is what lets us put Events Manager through the gauntlet of rigorous security testing and harden it properly, and the result is a stronger plugin for everyone. We’re all for it.

On a ligter note

We’ve brought back our recent Pro promotion for a little longer, as a thank you to everyone who has stuck with us and anyone joining now. It’s entirely separate from this fix, which is free for everyone in Events Manager 7.4.7, whether or not you use Pro.

Changelog

Events Manager 7.4.7

• Security: Fixed an authenticated SQL injection vulnerability in the REST API events and bookings search, disclosed by neurotx via Patchstack.

Events Manager Pro 3.9.5

• Security: Hardened the coupons date-scope search against SQL injection, scope dates are now validated before use.
• Fixed: Timeslot bookings in the Multiple Bookings cart could not show their details or be removed, the cart script did not escape the event:timeslot id in its selectors

The post Important Security Update – 7.4.7 appeared first on Events Manager for WordPress.

Events Manager 7.4.6

• Fixed: fatal error on tag pages, and in the admin area after updating, when an event type had no categories or tags enabled
• Fixed: tag pages skipped upcoming events for event types with tags but no categories
• Fixed: login failing on sites with a custom event type while debug output was displayed, a notice was printed before headers were sent
• Fixed: bookings tables on WordPress 7.1 repeated every row’s details on wide screens and could not expand rows on narrow ones
• Fixed: database errors on subsites in MultiSite Global Tables mode, event time ranges and timeslots were looked up in per-site tables that were never created and are now shared like other event data

Events Manager Pro 3.9.4

• Fixed: Joining a waiting list failing with an “Unrecognized action” message on cached sites, the form’s security token is now refreshed and an expired one is reported plainly
• Fixed: Spaces for a booking awaiting payment counted twice, which could show an event as full before it was
• Fixed: Bookings awaiting payment holding their spaces indefinitely when no unpaid booking expiry was set, spaces are now held only while an expiry can release them
• Fixed: Past Events Action cron running until the PHP time limit every minute when an event could not be moved, which always happened with the Trash action
• Fixed: Past Events Action trashing or hiding a whole recurring event with upcoming dates once one of its dates had passed
• Fixed: PayPal Standard refusing any booking with a coupon or surcharge applied, the cart item was sent without its quantity and PayPal answered with a generic error page
• Fixed: A booking discounted to zero still offering a PayPal payment link on My Bookings
• Fixed: The event editor telling owners “No coupons created yet” when their coupons are all set to apply site-wide or event-wide
• Fixed: PayPal Standard payments rejected with a merchant email mismatch when the PayPal Email setting is a secondary address of the PayPal account
• Changed: Bookings cancelled by Unpaid Bookings Expiry no longer send cancellation emails, an abandoned payment attempt now expires silently
• Fixed: Event image missing from PDF tickets, which also pushed the QR code off the page

The post Events Manager 7.4.6 and Pro 3.9.4 appeared first on Events Manager for WordPress.

Between the two core releases we’ve patched up a few more security vulnerabilities. All of them were responsibly disclosed and all of them were fixed and shipped before this post went live. Our thanks to the researchers who found them, and to Patchstack, Wordfence and WPScan for getting them to us.

We’ve got some exciting things in the pipeline, and we’ll have more to say about those when they’re ready to show. In the meantime we’ve been using these releases to close out long-standing bugs, including a few that have been on our list longer than we’d like.

So the rest is bug fixing, and there’s a good amount of it: bookings on cached sites, recurring events and their occurrences, a scattering of admin and block editor annoyances. Pro’s two releases lean toward waiting lists and payments, with a few PDF and email fixes alongside.

Full changelogs below.

Events Manager 7.4.4 and 7.4.5

• Security: Fixed a broken access control vulnerability. Reported by Hasyros via WPScan.
• Security: Fixed an information disclosure vulnerability. Reported by Karthik Ramakrishnan via WPScan.
• Security: Fixed an information disclosure vulnerability. Reported via Patchstack.
• Security: Fixed a missing authorization vulnerability, CVE-2026-92711. Reported by M4r0u4n3 via Wordfence.
• Security: Fixed a spoofing vulnerability, CVE-2026-92614. Reported by Shirshak via Wordfence.
• Added: em_get_my_bookings_url() accepts a person id and runs through the em_get_my_bookings_url filter, so BuddyPress links resolve the booking owner rather than the displayed user
• Changed: the admin bookings list and pending badge now show only the event type you are viewing, with an All Event Types filter for the combined list
• Fixed: newly booked attendees did not show on the event page until caches were flushed on sites with a persistent object cache, the event was cached with an emptied bookings list and never invalidated when bookings changed
• Fixed: booking submissions on cached sites failed with “unexpected network error” once the form’s security token expired, the form now says it expired and should be reloaded
• Fixed: the booking form security token was only refreshed for the standard booking form on cached sites
• Fixed: deleting a recurring event’s bookings reported success without deleting anything
• Fixed: repeating event occurrences had every previous occurrence’s date appended to their slug, breaking their URLs
• Fixed: the waiting list could not be joined for a fully booked occurrence of a recurring event
• Fixed: the pending spaces count ignored a forced refresh and could stay stale after a booking
• Fixed: events with an emoji in their name or content could not be saved on older database tables
• Fixed: events created by imports or the REST API were missing from listings until re-saved because their type and archetype were never set, existing events are repaired on upgrade
• Fixed: events using a custom archetype could not be edited, reporting “Sorry, you are not allowed to edit this post”
• Fixed: publishing an event in the block editor saved it as a draft when pre-publish checks were disabled
• Fixed: an end time earlier than the start time was not flagged while editing an event
• Fixed: an event ending after midnight on a later day was flagged as ending before it started
• Fixed: calendar date previews still rendered their modals when Date Preview Mode was set to Direct Link
• Fixed: the day view of the events page could not be paginated
• Fixed: the events search form could submit to the default language events page under WPML, and to the wrong page on themes overriding the search template
• Fixed: an empty events page setting could write a rewrite rule that broke the page being viewed until rewrite rules regenerated
• Fixed: fatal error on the category page after updating when an archetype has both categories and tags disabled
• Fixed: fatal error on first activation from WP-CLI or other non-admin contexts because the admin notice class was not loaded
• Fixed: scheduled imports failed because wp-cron and WP-CLI requests were subject to the public submitter consent check
• Fixed: the booking meta migration from 6.1 could rerun on every page load when a batch of bookings had no meta, slowing or crashing the site after an upgrade
• Fixed: bookings with a zero booking date in the database displayed as “November 29, -0001”
• Fixed: bulk actions such as Move to Trash in the admin failed to redirect due to a warning from the archetype post type check
• Fixed: deleting a booking from the admin bookings table still rendered its row actions and could print a warning into the response
• Fixed: admin booking tables could stop responding when the export or settings form was picked up before the main table form, notably on multisite
• Fixed: the booking submit button read “null” after an AJAX submission
• Fixed: radio buttons were invisible on the admin Add Booking form due to checkbox styling applied to radios
• Fixed: the edit icon in the admin bookings list spilled out of its column on narrow screens
• Fixed: a PHP warning was printed above the header row of CSV booking exports
• Fixed: a PHP deprecation notice was printed on the admin bookings pages when debugging was enabled
• Fixed: uninstalling from a sub-site in MS Global mode dropped the shared network event and booking tables, it is now refused with a link to the network settings
• Fixed: the bookings admin page turned the URL action into a booking lifecycle hook name, so listeners of em_bookings_add could fatal, a dedicated em_bookings_admin_action_* hook now fires alongside the legacy name
• Fixed: the REST API bookings list only returned bookings on the caller’s own events, even for users who can manage all bookings
• Fixed: the Test Email Settings button reported “Server Error” for administrators without the activate_plugins capability
• Fixed: EM_Event::set_timeslot_id() could never load a timeslot due to malformed SQL
• Tweaked: typo on the help page

Events Manager Pro 3.9.2 and 3.9.3

• Fixed: Quick Pay bookings were always created as Offline when more than one payment button was shown, breaking PayPal checkout
• Fixed: Unpaid bookings never expiring when only a payment method’s own Unpaid Bookings Expiry was set, and expiring after one minute when the expiry did run
• Fixed: Bookings awaiting payment holding their spaces indefinitely when no unpaid booking expiry was set, spaces are now held only while an expiry can release them
• Fixed: Spaces for a booking awaiting payment counted twice, which could show an event as full before it was
• Fixed: Payment method buttons rendering blank when their label setting had been saved empty, the payment method name is used again
• Fixed: Manual booking Amount Paid field defaulting to whitespace, causing an “Invalid payment amount” error
• Fixed: Waiting list unreachable on a fully booked occurrence of a recurring event, the signup form is now offered on the occurrence being viewed
• Fixed: Joining a waiting list failing with an “Unrecognized action” message on cached sites, the form’s security token is now refreshed and an expired one is reported plainly
• Fixed: Approving a waiting list booking could leave the booking form missing, log a temp_event_rsvp_spaces warning and release the held space to someone else
• Fixed: Waiting list approval emails could link to another member’s bookings page on BuddyPress sites
• Fixed: Booking reminders queued again every minute and sent repeatedly, the cron guard never matched its own schedule and nothing recorded a reminder as sent
• Fixed: Send Emails recipient estimate and send skipping waiting list bookings, which carry no ticket type
• Fixed: Ticket scanning and the frontend bookings manager returning a 404 until permalinks were re-saved, the endpoint now registers itself when the feature is enabled
• Fixed: Logo missing from PDF tickets and invoices, rendered as “Image not found” because the PDF renderer could not load it
• Fixed: Malformed title tag in the booking PDF template, which left the generated PDF with no document title
• Fixed: Booking form fields marked required blocking user profile saves in wp-admin
• Fixed: Attendee migration failing with a SQL error on legacy meta keys, leaving attendee data unmigrated
• Fixed: Typos in the waiting list and past events settings descriptions

Thanks, as always, for trusting us with your events, your attendees and their data.

The post Events Manager 7.4.5 and Pro 3.9.3 appeared first on Events Manager for WordPress.

It is reflected XSS, not stored, and the difference matters more than it might sound. This release
also clears up some confusion around 7.4.2, and we would rather explain it than leave it sitting there.

Reflected, not stored

Some trackers that relayed Patchstack’s report list this as stored XSS. It is reflected, and if you
have been trying to work out your exposure that distinction is the whole question.

A stored issue means something malicious is already sitting in your database, running for anyone who
loads the page. A reflected one never touches your site’s data. It only fires for someone who follows
a crafted link, and it does nothing until they do. Sites listed as carrying a stored vulnerability
went looking for planted payloads that were never going to be there.

What we thought, and what it actually was

The report surfaced shortly after 7.4.1, which carried a batch of significant security fixes. Looking
for it, we found an unfiltered variable that looked like it belonged to the same family, and it seemed
reasonable that the report had come out of a rescan following that release.

So we fixed what we found in 7.4.2, and attached a “possibly” to the changelog because we could not
confirm it.

• Fixed in 7.4.2, self-diagnosed: an unfiltered variable found in our own review. Real, and worth
  fixing. Not the reported one.
• Fixed in 7.4.3, CVE-2026-66457: reflected XSS via list formatting parameters. The reported
  vulnerability, in a different part of the code. Still live on 7.4.2.

It turned out to be a different issue in a different part of the code, so 7.4.2 did not fix what
people believed it fixed. If you are running it, please update.

A recipe for confusion

Over the past few months we have patched close to forty security vulnerabilities across the Events
Manager family. Most we identified ourselves through the internal review programme we wrote about in July rather than having them reported to us, and a number of those were then reported by researchers after we had already shipped the fix.

Those fixes do not update uniformly across the vulnerability databases. Issues we resolved some time ago are still listed as open in one channel and patched in another, and the versions each one names do not always agree.

Two of those earlier updates included reflected XSS fixes of their own. By the time this report appeared there were already several similar-sounding entries in circulation, at different stages of being marked fixed, naming different versions.

Add a notification that never reached us, and it was a recipe for confusion. We do not blame anyone
for being unsure whether they were exposed, or on which version.

Why this took us longer than usual

That notification normally gives us the details and a window to patch before anything is published. Without it, the report went public while we were still in the dark about what it described, which left us knowing a vulnerability existed in our plugin without being able to see what it was.

So we approached Patchstack directly and asked. They worked with us to give us access to the report,
and we are grateful for that. Once we had it in hand we reproduced the issue, confirmed it was live on
7.4.2, wrote the fix and tested it.

7.4.3 changelog

• Security: Fixed an XSS vulnerability CVE-2026-66457. Reported by Mukhlis Amien via Patchstack.
• Security: Fixed low-severity (self-diagnosed) vulnerability allowing unfiltered shortcode output
  under specific setup/variable circumstances.
• Fixed: fatal error when the booking cancellation cut-off is set as an interval such as P2D rather
  than a number of hours
• Fixed: fatal error saving a location with an attribute no longer in your configured attribute list
• Fixed: quotes in a custom calendar month format broke the month picker
• Tweaked: documentation links now use https

With thanks to Patchstack for working with us to get us the detail we needed.

If you run Events Manager, the most useful thing you can do today is update. Thank you for trusting us
with your events, your attendees and their data.

The post EM 7.4.3 Security Update appeared first on Events Manager for WordPress.

Just recently we had a major security update where we self-identified over 30
security vulnerabilities. Despite the thoroughness of that review, this latest
round highlights three important points:

• Even the best review can overlook security issues. Events Manager is constantly
  under security scrutiny, and yet some issues still surface long after the code
  that introduced them was written.
• AI isn’t excluded above either. We used multiple models in our scans, and issues
  still got past both our own review and the automated scanning the wider
  WordPress ecosystem runs over plugin releases.
• No code is safe from security threats, constant re-review is necessary.

We take every measure to write and maintain safe code, we welcome and appreciate
the regular scrutiny, it makes us better and stronger. We thank the recent
contributors who responsibly disclosed these vulnerabilities via Wordfence and
WordPress.

If you haven’t updated yet, please do so now.

Upcoming Changes – Bookings

Aside from this, we’ve been hard at work on a major project. It deserves its own
post, so we’ll just give you a little teaser.

We’re reworking bookings, something we’ve been mulling over and working towards
through our foundational updates over the past two years.

Not for events, not for appointments, for everything.

Anything reserving a space in place and/or time.

Our goal has always been to create the most solid events framework, and that
also means a flexible bookings engine. We look forward to taking bookings in
general to the next level.

Stay tuned!

7.4.1 Changelog

The post 7.4.1 – Security Updates and Upcoming Features appeared first on Events Manager for WordPress.

Events Manager Pro 3.9.1 adds signatures as a native field type. Drop one into any booking or attendee form, and the signed record lives right on the booking.

Sign on the dotted line, in the booking form

Add a signature field, paste in your waiver or consent text, and you are done. When someone books they read the document and sign there and then, drawing with a finger or mouse, or typing their name if they prefer (much friendlier on a phone). No third-party account, no per-signature fees, no limits, and everything stays on your own site.

Signature fields work on attendee forms as well, so you can require a signature from every person attending, not just the person paying. One parent booking three children means three signed consent forms, each attached to the right attendee.

Want to see it before you set it up? Try a real booking form with the signature field on our demo site.

More than a picture of a squiggle

The image alone proves very little. What makes a signature worth having is the evidence recorded around it, so every signature is stored with a sealed, tamper-evident record: who signed, the exact document and version they saw, when they signed, and their explicit agreement to sign electronically. You get a full certificate on the booking with an integrity check, and the signer is emailed their own copy automatically. The feature page has the detail, including how the built-in signing maps to e-signature law (SES, AES and where each one fits).

No signature, no confirmation

Sometimes a signed waiver is a condition of taking part, not an optional extra. Turn on the signature hold and the booking stays pending, marked “Awaiting signature”, until every required signature is in. Anyone who did not sign at checkout gets a secure personal link to a signing page, no account needed, and the booking moves forward the moment they sign.

Coming soon: DocuSign and Dropbox Sign

Built-in signing is all most events need, and it is here now. Coming next, for organisers whose insurer or legal team wants a third party’s certificate of completion, each signature field will be able to hand signing off to DocuSign or Dropbox Sign instead. We will announce that separately once it is ready.

Get started

Signature images can be cleared automatically after a retention period you set per field, while the sealed record is kept, so you are not stockpiling personal data you no longer need. Signature records are included in WordPress privacy exports too.

The update is waiting for you under Plugins → Update. See the waivers and digital signatures feature page for the full tour, or the setup guide to add your first signed waiver. If anything misbehaves, drop us a line on the support forums.

Happy event-managing, and may your waivers always come back signed!

Changelog

Events Manager Pro 3.9.1

• Added: Certificate of completion for each signed document, a sealed PDF downloadable from the booking, optionally attached to the registrant and admin booking emails, and emailed to the signer.
• Added: Sign-later signatures collected after booking via a private link. A booking is now held pending only while a required signature is outstanding; an optional signature never blocks it.
• Added: Dedicated signature completion emails to the registrant and admin, sent once every required signature is in, with editable subject and body templates.
• Added: #_BOOKINGSIGNATUREURL placeholder and the {booking_has_unsigned_signatures} / {booking_no_unsigned_signatures} conditional placeholders for booking emails.
• Tweaked: The after-booking signing page now lists outstanding signatures as one checklist, each opening the signing modal, and inherits your theme styling.
• Fixed: Inline signature fields on the booking form no longer pick up conflicting theme styling on their controls.
• Fixed: Paid booking totals now account for booking status across both gateway trees.
• Fixed: Waitlist cancel button not appearing on the waitlist status page.

The post Pro 3.9.1 – Signatures and Waivers appeared first on Events Manager for WordPress.

At Events Manager, security is part of how we build, not a step we bolt on afterwards. This release is the clearest example of that we have shipped, and we want to be open about the work behind it.

The Fable in this story…

A few weeks ago, when Claude Fable first became available, we jumped on it. We had been following the Mythos project ever since chatter surfaced about it; Claude Fable is the version of that model eventually released for public use.

In case you were unaware: Mythos is the latest and greatest model from Anthropic (the makers of Claude). This model is apparently so capable in cybersecurity that Anthropic has not released it publicly, instead making it available in preview to a limited group of critical-industry partners and open source projects under Project Glasswing (lots of ‘cool’ naming here). The results so far speak for themselves: over 10,000 high or critical severity vulnerabilities found across some of the world’s most important software, including 271 patched in Firefox alone!

Fable is the ‘safer’ version of Mythos, but still a powerful new AI model that can run the kind of deep, adversarial code review that used to take a specialist team days. The day it came out, we put it straight to work on our own code. We did not hold back on the token usage cost, which was not small!

Reviewing the results

That first review was as thorough as anything we have ever run against Events Manager. Access to Fable at that depth was then restricted, so we could not simply repeat it on demand. However, we had fortunately jumped on it just in time, and the eventual tally was not surprising (given what the major tech companies encountered) but daunting regardless: 32 security vulnerabilities!

To put that into context, we have not received that many security reports… ever… for all our plugins we’ve ever published! That says less about our code than about how far this tooling has come, and it is exactly why we moved on it early.

Sidenote: Historical Security Vulnerability Reporting

Open source software naturally invites more scrutiny, simply because the code is out there for anyone to read: cybersecurity analysts and attackers alike. Inevitably, we receive security reports when issues are found, either by direct contact or via responsible disclosure channels such as Patchstack, Dell Secureworks, Wordfence or the WordPress.org plugins team themselves. This may all sound scary, but whilst malicious users can scan open source software for exploits, so too can defenders and white-hat analysts.

Over the past 15 years, we may on average have received 1 report per year, for all our plugins combined! These reports were more concentrated in the latter years as WordPress (and our plugins) grew in popularity, inviting more scrutiny over their security.

Ultimately, the upside is we now had a unique opportunity to make Events Manager safer than ever.

What we found

For transparency, and without publishing anything that would help an attacker, here is the shape of what we found and fixed across the Events Manager family.

By severity

By category

On exploitability

Regarding the actual exploitability of this list: the single critical issue and most of the high-severity items required particular conditions or a degree of existing access, and several were defence-in-depth hardening rather than open doors. We are deliberately not publishing specifics, endpoints, or reproduction steps. Responsible disclosure means fixing quietly and shipping first, not handing anyone a map.

From findings to fixes

We took every finding, re-reviewed it by hand against the source, reproduced what could be reproduced in a controlled test environment, patched it, and tested the patch. This release is the result.

We also coordinated with the WordPress.org plugins team to release this in a responsible fashion and timeline, without disclosing the vulnerabilities in the changelogs immediately. This allowed time for the release to propagate via regular and automatic updates held back by the 24 hour Protect The Shire (PTS) delay, which we covered in our recent post on plugin updating recommendations.

Still looking

We run follow-up reviews continually. During this release, we did our due diligence and deliberately used more than one model, vendor and tool to double-check our work. We will keep doing this as the tooling improves.

For Pro customers on older versions

If you are not able to move to the latest Events Manager Pro 3.9 release, we have prepared patched builds of the earlier versions, which you can download from your account area. We strongly recommend applying one of these as soon as possible; we are contacting our customers individually as well to make sure they’re aware and staying safe.

Update today

If you run Events Manager or Events Manager Pro, the most useful thing you can do today is update to the latest version. Thank you for trusting us with your events, your attendees, and their data.

With thanks to Wordfence and the researcher molten bit, who separately reported two of the issues resolved in this release. The remainder were found through our own review.

The post IMPORTANT Security Update – A ‘Mythosical’ Fable appeared first on Events Manager for WordPress.

In practical terms: when we publish a new version of Events Manager, your site will not offer it straight away. The files are published on WordPress.org immediately, but the update notification on your Plugins and Updates pages is held back, whether you update manually or automatically, until the hold lifts.

We support the change. It also has a side effect worth explaining, and a new option in Events Manager to go with it.

Why we support it

Any effort to make the WordPress.org plugin repository more secure is welcome, and this is a sound plan. AI is making it easier for bad actors to inject malicious code into legitimate releases, and a review window before an update is distributed to hundreds of thousands of sites makes total sense.

For us, though, the upside that matters most is closer to home: the hold can slow the mass rollout of an update containing a serious bug, giving the developer time to fix it before most sites receive it. Automatic updates are dangerous on many levels in the context of complex plugins like Events Manager, and we have never been particular fans of them (for Events Manager); we prefer site owners to update manually, with someone watching in case something goes wrong.

The catch

That upside only works if site owners are notified and can update manually the moment a fix is released. Currently, they cannot. The hold delays the update notification for everyone, manual and automatic alike, and it applies to the fix as much as to the bug. So when a legitimate security issue or a major bug needs fixing quickly, we are bound to the full 24 hours. The plugins team is quick to react and do a great job; every experience we have had with them has been a good one. However, time zone differences and working with a team that is understandably busy handling 73k plugins can make this a tricky affair.

We felt this recently. An update caused PHP fatal errors when listing events, but only for sites with a specific combination of settings. Events Manager has a lot of options, and however much we expand our test coverage, it is these edge-case combinations rather than universal failures that produce most fatal errors. Our usual response is a same-day fix, which historically meant most sites never saw the faulty version at all. Under the hold, reports only began arriving as the update gradually reached sites up to a day later, at a time we could not predict, and any fix we publish then waits out its own 24 hours.

Our solution in 7.3.7.4.2

Events Manager has let you opt in to checking for development versions for many years. We have now extended that same mechanism to stable releases.

Enable Always check the latest stable version? and Events Manager will ask WordPress.org directly for the latest published stable release, showing it on your Plugins and Updates pages the moment we release it, ready for you to install with the usual update button. For a one-off check, the Re-Check Updates button now does the same thing once.

Deliberately, this never touches automatic updates:

• Versions found this way are explicitly excluded from the WordPress automatic update system.
• The check only runs while an administrator is using the admin area, never during the scheduled background checks that automatic updates rely on.
• Automatic updates continue to follow WordPress.org’s own schedule, 24-hour hold included.

For those who want the opposite extreme, Events Manager 7.9 will add an EM_AUTO_UPDATES constant: define it as true in wp-config.php and these early releases will be applied by automatic updates as well. It is not something we would necessarily recommend, at least not now, but again, the point is giving you options.

You will find the new settings under Events > Settings > General, in the Admin Tools (Advanced) section. If you manage updates yourself, we recommend turning the stable check on: the updates you get fastest are exactly the ones you want fastest, the point releases that fix problems in the version before. If your site updates unattended, leave it off (the default) and the full review window still protects you.

A fair balance

We think this offers the best of both worlds: the review window stays fully intact for unattended updates, while informed site owners keep the freedom to update the moment a release is out. The announcement notes the window “could be reduced to minutes as the process evolves”, which we would welcome. If the core or plugin review teams see a flaw in our approach, we would welcome that conversation too. Until then, the choice is yours, which is rather the point.

The post Plugin Updating – Recommendations appeared first on Events Manager for WordPress.

What it does

When something happens on your site that you’d want to know about, the app tells you. A booking comes in, a booking is cancelled, someone submits an event for review: you get a notification, tap it, and you’re taken straight to it, you can manage events and bookings straight from your phone, with fast REST API connections. No more refreshing your admin to see whether that last ticket sold.

This first release covers three notifications: new bookings, booking cancellations, and new events submitted for review. Each one respects your existing permissions, so you’ll only be alerted about things you’re allowed to manage. A contributor who can handle only their own events won’t be notified about everyone else’s bookings.

Getting started

You’ll need Events Manager 7.3.7 or later on your site. That release added the app notification support the app connects to. The app itself is available now on the App Store.

You’ll find the download link and pricing on our mobile apps page, and a step-by-step guide to connecting it to your site in the documentation.

The post Mobile App Now In App Store! appeared first on Events Manager for WordPress.