Just recently we had a major security update where we self-identified over 30
security vulnerabilities. Despite the thoroughness of that review, this latest
round highlights three important points:

• Even the best review can overlook security issues. Events Manager is constantly
  under security scrutiny, and yet some issues still surface long after the code
  that introduced them was written.
• AI isn’t excluded above either. We used multiple models in our scans, and issues
  still got past both our own review and the automated scanning the wider
  WordPress ecosystem runs over plugin releases.
• No code is safe from security threats, constant re-review is necessary.

We take every measure to write and maintain safe code, we welcome and appreciate
the regular scrutiny, it makes us better and stronger. We thank the recent
contributors who responsibly disclosed these vulnerabilities via Wordfence and
WordPress.

If you haven’t updated yet, please do so now.

Upcoming Changes – Bookings

Aside from this, we’ve been hard at work on a major project. It deserves its own
post, so we’ll just give you a little teaser.

We’re reworking bookings, something we’ve been mulling over and working towards
through our foundational updates over the past two years.

Not for events, not for appointments, for everything.

Anything reserving a space in place and/or time.

Our goal has always been to create the most solid events framework, and that
also means a flexible bookings engine. We look forward to taking bookings in
general to the next level.

Stay tuned!

7.4.1 Changelog

The post 7.4.1 – Security Updates and Upcoming Features appeared first on Events Manager for WordPress.

Events Manager Pro 3.9.1 adds signatures as a native field type. Drop one into any booking or attendee form, and the signed record lives right on the booking.

Sign on the dotted line, in the booking form

Add a signature field, paste in your waiver or consent text, and you are done. When someone books they read the document and sign there and then, drawing with a finger or mouse, or typing their name if they prefer (much friendlier on a phone). No third-party account, no per-signature fees, no limits, and everything stays on your own site.

Signature fields work on attendee forms as well, so you can require a signature from every person attending, not just the person paying. One parent booking three children means three signed consent forms, each attached to the right attendee.

Want to see it before you set it up? Try a real booking form with the signature field on our demo site.

More than a picture of a squiggle

The image alone proves very little. What makes a signature worth having is the evidence recorded around it, so every signature is stored with a sealed, tamper-evident record: who signed, the exact document and version they saw, when they signed, and their explicit agreement to sign electronically. You get a full certificate on the booking with an integrity check, and the signer is emailed their own copy automatically. The feature page has the detail, including how the built-in signing maps to e-signature law (SES, AES and where each one fits).

No signature, no confirmation

Sometimes a signed waiver is a condition of taking part, not an optional extra. Turn on the signature hold and the booking stays pending, marked “Awaiting signature”, until every required signature is in. Anyone who did not sign at checkout gets a secure personal link to a signing page, no account needed, and the booking moves forward the moment they sign.

Coming soon: DocuSign and Dropbox Sign

Built-in signing is all most events need, and it is here now. Coming next, for organisers whose insurer or legal team wants a third party’s certificate of completion, each signature field will be able to hand signing off to DocuSign or Dropbox Sign instead. We will announce that separately once it is ready.

Get started

Signature images can be cleared automatically after a retention period you set per field, while the sealed record is kept, so you are not stockpiling personal data you no longer need. Signature records are included in WordPress privacy exports too.

The update is waiting for you under Plugins → Update. See the waivers and digital signatures feature page for the full tour, or the setup guide to add your first signed waiver. If anything misbehaves, drop us a line on the support forums.

Happy event-managing, and may your waivers always come back signed!

Changelog

Events Manager Pro 3.9.1

• Added: Certificate of completion for each signed document, a sealed PDF downloadable from the booking, optionally attached to the registrant and admin booking emails, and emailed to the signer.
• Added: Sign-later signatures collected after booking via a private link. A booking is now held pending only while a required signature is outstanding; an optional signature never blocks it.
• Added: Dedicated signature completion emails to the registrant and admin, sent once every required signature is in, with editable subject and body templates.
• Added: #_BOOKINGSIGNATUREURL placeholder and the {booking_has_unsigned_signatures} / {booking_no_unsigned_signatures} conditional placeholders for booking emails.
• Tweaked: The after-booking signing page now lists outstanding signatures as one checklist, each opening the signing modal, and inherits your theme styling.
• Fixed: Inline signature fields on the booking form no longer pick up conflicting theme styling on their controls.
• Fixed: Paid booking totals now account for booking status across both gateway trees.
• Fixed: Waitlist cancel button not appearing on the waitlist status page.

The post Pro 3.9.1 – Signatures and Waivers appeared first on Events Manager for WordPress.

At Events Manager, security is part of how we build, not a step we bolt on afterwards. This release is the clearest example of that we have shipped, and we want to be open about the work behind it.

The Fable in this story…

A few weeks ago, when Claude Fable first became available, we jumped on it. We had been following the Mythos project ever since chatter surfaced about it; Claude Fable is the version of that model eventually released for public use.

In case you were unaware: Mythos is the latest and greatest model from Anthropic (the makers of Claude). This model is apparently so capable in cybersecurity that Anthropic has not released it publicly, instead making it available in preview to a limited group of critical-industry partners and open source projects under Project Glasswing (lots of ‘cool’ naming here). The results so far speak for themselves: over 10,000 high or critical severity vulnerabilities found across some of the world’s most important software, including 271 patched in Firefox alone!

Fable is the ‘safer’ version of Mythos, but still a powerful new AI model that can run the kind of deep, adversarial code review that used to take a specialist team days. The day it came out, we put it straight to work on our own code. We did not hold back on the token usage cost, which was not small!

Reviewing the results

That first review was as thorough as anything we have ever run against Events Manager. Access to Fable at that depth was then restricted, so we could not simply repeat it on demand. However, we had fortunately jumped on it just in time, and the eventual tally was not surprising (given what the major tech companies encountered) but daunting regardless: 32 security vulnerabilities!

To put that into context, we have not received that many security reports… ever… for all our plugins we’ve ever published! That says less about our code than about how far this tooling has come, and it is exactly why we moved on it early.

Sidenote: Historical Security Vulnerability Reporting

Open source software naturally invites more scrutiny, simply because the code is out there for anyone to read: cybersecurity analysts and attackers alike. Inevitably, we receive security reports when issues are found, either by direct contact or via responsible disclosure channels such as Patchstack, Dell Secureworks, Wordfence or the WordPress.org plugins team themselves. This may all sound scary, but whilst malicious users can scan open source software for exploits, so too can defenders and white-hat analysts.

Over the past 15 years, we may on average have received 1 report per year, for all our plugins combined! These reports were more concentrated in the latter years as WordPress (and our plugins) grew in popularity, inviting more scrutiny over their security.

Ultimately, the upside is we now had a unique opportunity to make Events Manager safer than ever.

What we found

For transparency, and without publishing anything that would help an attacker, here is the shape of what we found and fixed across the Events Manager family.

By severity

By category

On exploitability

Regarding the actual exploitability of this list: the single critical issue and most of the high-severity items required particular conditions or a degree of existing access, and several were defence-in-depth hardening rather than open doors. We are deliberately not publishing specifics, endpoints, or reproduction steps. Responsible disclosure means fixing quietly and shipping first, not handing anyone a map.

From findings to fixes

We took every finding, re-reviewed it by hand against the source, reproduced what could be reproduced in a controlled test environment, patched it, and tested the patch. This release is the result.

We also coordinated with the WordPress.org plugins team to release this in a responsible fashion and timeline, without disclosing the vulnerabilities in the changelogs immediately. This allowed time for the release to propagate via regular and automatic updates held back by the 24 hour Protect The Shire (PTS) delay, which we covered in our recent post on plugin updating recommendations.

Still looking

We run follow-up reviews continually. During this release, we did our due diligence and deliberately used more than one model, vendor and tool to double-check our work. We will keep doing this as the tooling improves.

For Pro customers on older versions

If you are not able to move to the latest Events Manager Pro 3.9 release, we have prepared patched builds of the earlier versions, which you can download from your account area. We strongly recommend applying one of these as soon as possible; we are contacting our customers individually as well to make sure they’re aware and staying safe.

Update today

If you run Events Manager or Events Manager Pro, the most useful thing you can do today is update to the latest version. Thank you for trusting us with your events, your attendees, and their data.

With thanks to Wordfence and the researcher molten bit, who separately reported two of the issues resolved in this release. The remainder were found through our own review.

The post IMPORTANT Security Update – A ‘Mythosical’ Fable appeared first on Events Manager for WordPress.

In practical terms: when we publish a new version of Events Manager, your site will not offer it straight away. The files are published on WordPress.org immediately, but the update notification on your Plugins and Updates pages is held back, whether you update manually or automatically, until the hold lifts.

We support the change. It also has a side effect worth explaining, and a new option in Events Manager to go with it.

Why we support it

Any effort to make the WordPress.org plugin repository more secure is welcome, and this is a sound plan. AI is making it easier for bad actors to inject malicious code into legitimate releases, and a review window before an update is distributed to hundreds of thousands of sites makes total sense.

For us, though, the upside that matters most is closer to home: the hold can slow the mass rollout of an update containing a serious bug, giving the developer time to fix it before most sites receive it. Automatic updates are dangerous on many levels in the context of complex plugins like Events Manager, and we have never been particular fans of them (for Events Manager); we prefer site owners to update manually, with someone watching in case something goes wrong.

The catch

That upside only works if site owners are notified and can update manually the moment a fix is released. Currently, they cannot. The hold delays the update notification for everyone, manual and automatic alike, and it applies to the fix as much as to the bug. So when a legitimate security issue or a major bug needs fixing quickly, we are bound to the full 24 hours. The plugins team is quick to react and do a great job; every experience we have had with them has been a good one. However, time zone differences and working with a team that is understandably busy handling 73k plugins can make this a tricky affair.

We felt this recently. An update caused PHP fatal errors when listing events, but only for sites with a specific combination of settings. Events Manager has a lot of options, and however much we expand our test coverage, it is these edge-case combinations rather than universal failures that produce most fatal errors. Our usual response is a same-day fix, which historically meant most sites never saw the faulty version at all. Under the hold, reports only began arriving as the update gradually reached sites up to a day later, at a time we could not predict, and any fix we publish then waits out its own 24 hours.

Our solution in 7.3.7.4.2

Events Manager has let you opt in to checking for development versions for many years. We have now extended that same mechanism to stable releases.

Enable Always check the latest stable version? and Events Manager will ask WordPress.org directly for the latest published stable release, showing it on your Plugins and Updates pages the moment we release it, ready for you to install with the usual update button. For a one-off check, the Re-Check Updates button now does the same thing once.

Deliberately, this never touches automatic updates:

• Versions found this way are explicitly excluded from the WordPress automatic update system.
• The check only runs while an administrator is using the admin area, never during the scheduled background checks that automatic updates rely on.
• Automatic updates continue to follow WordPress.org’s own schedule, 24-hour hold included.

For those who want the opposite extreme, Events Manager 7.9 will add an EM_AUTO_UPDATES constant: define it as true in wp-config.php and these early releases will be applied by automatic updates as well. It is not something we would necessarily recommend, at least not now, but again, the point is giving you options.

You will find the new settings under Events > Settings > General, in the Admin Tools (Advanced) section. If you manage updates yourself, we recommend turning the stable check on: the updates you get fastest are exactly the ones you want fastest, the point releases that fix problems in the version before. If your site updates unattended, leave it off (the default) and the full review window still protects you.

A fair balance

We think this offers the best of both worlds: the review window stays fully intact for unattended updates, while informed site owners keep the freedom to update the moment a release is out. The announcement notes the window “could be reduced to minutes as the process evolves”, which we would welcome. If the core or plugin review teams see a flaw in our approach, we would welcome that conversation too. Until then, the choice is yours, which is rather the point.

The post Plugin Updating – Recommendations appeared first on Events Manager for WordPress.

What it does

When something happens on your site that you’d want to know about, the app tells you. A booking comes in, a booking is cancelled, someone submits an event for review: you get a notification, tap it, and you’re taken straight to it, you can manage events and bookings straight from your phone, with fast REST API connections. No more refreshing your admin to see whether that last ticket sold.

This first release covers three notifications: new bookings, booking cancellations, and new events submitted for review. Each one respects your existing permissions, so you’ll only be alerted about things you’re allowed to manage. A contributor who can handle only their own events won’t be notified about everyone else’s bookings.

Getting started

You’ll need Events Manager 7.3.7 or later on your site. That release added the app notification support the app connects to. The app itself is available now on the App Store.

You’ll find the download link and pricing on our mobile apps page, and a step-by-step guide to connecting it to your site in the documentation.

The post Mobile App Now In App Store! appeared first on Events Manager for WordPress.

Please update: a security fix

7.3.7.1 fixes three security issues responsibly disclosed to us by Jakub Herman: an unauthenticated object injection through booking meta data, SQL injection in some of our slug lookups, and a booking summary that could be read without the right permissions. They affected 7.3.6 and earlier. There’s no cause for alarm, but we do recommend updating promptly, particularly if your site takes bookings from the public. Our thanks to Jakub for reporting these the right way.

A new way to edit your events

The block editor now has a proper home for your event details: a tidy, tabbed canvas in place of the old column of separate boxes, with three layouts to choose from. Events Manager Pro 3.8.5 plugs straight into it, adding your Custom Automated Emails as an Emails tab. Documentation soon to follow!

A mobile app is on the way here!

Edit: The app is now available on the Apple App Store, see our product page for links and info.

We’re building an Events Manager mobile app, and the first piece ships in 7.3.7.1: a push notification framework in core. When the app lands, you’ll be able to get a notification on your phone when a booking comes in, when one is cancelled, or when an event is submitted for review. Announcement post on the way!

REST API: recurring events and timeslots

7.3.7.1 adds read and write support for recurring events and timeslots, two of the trickier parts of Events Manager to handle through the API. Handy if you run a headless site, build integrations, or manage your calendar through our MCP support.

Pro: Custom Automated Emails in the block editor

Events Manager Pro 3.8.5 brings your Custom Automated Emails into the block editor as a dedicated Emails tab, to match the new core editor. On older versions of core they stay as a normal panel, so nothing breaks if you haven’t updated both.

Changelog

Events Manager 7.3.7.1

• Added: Push notification framework for the upcoming Events Manager mobile app: device registration, per-notification-type controls, and a settings UI.
• Added: Block editor Event Details canvas panel with tabbed When and Bookings sections; canvas, tabbed and stacked layout setting; namespaced EM\Editor tab system for event and location editors; the EM runtime now loads inside the canvas iframe with full admin CSS and recurrence support.
• Added: REST API recurring-event and timeslot read/write support.
• Security: Fixed unauthenticated object injection via booking meta, SQL injection in iCal, feed and permalink slug lookups, and unauthenticated booking summary disclosure. Reported by Jakub Herman. We recommend updating.
• Fixed: PHP 8.x infinite loop in the multi-day calendar slot allocator when two events overlap on the same day.
• Fixed: WordPress 6.7+ “translation triggered too early” debug notice; API consent-scope now registers on init instead of plugins_loaded.
• Fixed: Fatal array_intersect() error on the Bookings list when sorted by a single column.
• Fixed: Fatal “Cannot access offset of type string on string” on settings save when dbem_data was corrupted to a plain string.
• Fixed: Booked seat and ticket counts showed as 0 throughout the admin due to an inverted condition.
• Fixed: “Limit CSS loading” setting ignored since 7.3; the stylesheet was enqueued on every front-end page regardless of the setting.
• Fixed: Fatal “Cannot redeclare em_admin_ms_locations()” on multisite subsite admin.
• Fixed: Recurrence reschedule button and double timeslot bug in the block canvas.

Events Manager Pro 3.8.5

• Added: Custom Automated Emails now appear as a dedicated “Emails” tab in the block (Gutenberg) event editor. Pairs with Events Manager 7.3.7.1; on older core they remain a normal metabox.
• Fixed: Selecting a custom booking or attendee form when creating an event via the REST/MCP API could be wrongly rejected as “Bookings must be enabled”, even when the request enabled bookings.

The post Events Manager 7.3.7 and Pro 3.8.5 appeared first on Events Manager for WordPress.

New: EU right-of-withdrawal compliance (the Widerrufsbutton)

A new EU consumer-protection rule came into force this week, on 19 June 2026. Germany calls it the Widerrufsbutton (§ 356a BGB), but the obligation applies across the EU under Article 11a of the Consumer Rights Directive, as amended by Directive (EU) 2023/2673.

The rule itself is simple. If you sell online to consumers who have a statutory right of withdrawal, you have to give them a prominent “Withdraw from contract” function that works without logging in and stays reachable throughout the withdrawal period.

Events Manager now includes this, built to work wherever in the EU you trade:

• A guest-accessible, two-step withdrawal flow (declare, then confirm), with no account needed.
• A secure 24-hour magic link for customers who don’t have their booking reference to hand, so they can pick the booking from a list.
• An acknowledgment-of-receipt email that records the withdrawal statement and the exact date and time of receipt. It confirms receipt only, not validity.
• Only the data the law allows: name, booking reference, email. A postal address is never required.
• An optional footer link so the function is always within reach.
• German and English copy out of the box, with every legally sensitive label and email editable.

Two things worth knowing. The feature is opt-in and off by default, because most Events Manager sites sell fixed-date events (concerts, shows, a class on a set date), and those are exempt from the right of withdrawal. The sites that need it are the ones selling courses, memberships, retreats, digital downloads and other non-dated services, along with anyone running a mixed catalogue. And Events Manager provides the mechanism, not the legal wording: you paste in your own withdrawal policy and model form from your legal adviser, and we give you the slot for it.

Full setup notes and guidance on who needs this are in the right-of-withdrawal documentation.

Events Manager 7.3.6

A few other things have landed in core recently:

• REST API v1, with full event, location, booking and ticket endpoints, partial updates, a validation endpoint, and extension hooks so Pro and custom event types use the same pipeline.
• AI through MCP. A Model Context Protocol adapter and setup wizard let AI assistants read and manage your events through the authenticated API, now using WordPress application passwords for authentication.
• Gutenberg blocks for the Events Calendar, Events List and Locations List, plus an Event When block for editing dates, times and recurrence directly on the canvas.
• Multiple timeslots per day, including overlapping slots and buffers between them.
• A calendar “dots” style that marks busy days with coloured dots, with a per-day event limit.
• Security fixes for several responsibly disclosed vulnerabilities across the 7.3.x line. We recommend everyone update.

Events Manager Pro 3.8.4

• A waiting-list overhaul: the open, full and closed conditionals now behave correctly, the signup button label is editable, the original booker is preserved when you edit a waitlist booking, the login-form setting is respected, and the row actions work again.
• Booking on behalf of someone else. Managers can create a booking for a guest or another user through the REST/MCP API, mapped onto your custom booking form.
• Pro on the MCP server, so custom forms, coupons and gateways are available to AI assistants alongside core.
• Manual and at-the-gate payments via REST, for marking a booking paid without going through the gateway flow.

Payments: two new gateways, plus updates

Two new ways to take payment:

• Square brings two gateways in one add-on: Square Checkout, a hosted payment page, and Square Web Payments, an embedded card form that keeps customers on your site. Both work in live and sandbox modes, with webhooks and refund and dispute handling. See the Square documentation.
• Xero adds an invoicing, pay-later option. When a booking is made, Events Manager raises an authorised invoice in your connected Xero organisation and either sends the customer to Xero’s online invoice page or emails it to them. The booking confirms automatically once it’s paid, which works well for B2B and invoice-based bookings. See the Xero documentation.

Updates to two existing gateways:

• PayPal 1.4: the Checkout buttons and card fields now render correctly on recurring-event and timeslot booking forms, and we cleared a translation-loading notice on WordPress 6.7 and later.
• WooCommerce 1.1: full HPOS (High-Performance Order Storage) compatibility and support for the new Cart and Checkout blocks, plus fixes to multi-ticket carts, payment retries and checkout attendee details.

More to come

There’s more here than one post can cover, so we’ll follow up with separate write-ups on the right-of-withdrawal flow, the AI and MCP integration, and the new gateways. In the meantime, update from your dashboard and let us know how you get on.

The post Events Manager 7.3.6, Pro 3.8.4, Square, Xero, WooCommerce, PayPal and more! appeared first on Events Manager for WordPress.

We’ve got a bunch of updates out and on the way, including a follow-up update to EM in the works. We’ll touch on the add-on updates in separate posts. Lots happening, stay tuned!

The post Events Manager 7.3.5 appeared first on Events Manager for WordPress.

We put together a short walkthrough video to show you exactly what this looks like from start to finish. Watch till the end to see an upcoming surprise :)

What’s in the demo

Setting up the MCP server (Part 1)
The whole setup lives inside Events Manager’s settings page. There’s a new AI / MCP Setup box that walks you through three steps: confirm you’re on WordPress 7.0+, install and activate the official MCP Adapter plugin (one click from the settings page), and copy the MCP Server URL that appears once everything is ready.

Connecting Claude (Part 2)
With the URL in hand, we head over to Claude, add a custom connector, and hit Connect. Claude discovers all of Events Manager’s capabilities — listing events, checking availability, creating bookings, managing locations, and more — and asks which permissions to grant. We allow everything for the demo, but in production you’d scope this to exactly what the AI needs to do.

The live demo (Parts 3 & 4)
This is where it gets interesting. We gave Claude a single prompt: find five upcoming cooking classes in London, import them as events, create matching locations, add tickets, generate some test bookings, and build out a category and tag. Even running on Sonnet 4.6 — a mid-tier model — Claude worked through the whole task autonomously. It searched for venues, created the events, handled image sideloading (including self-correcting when the first approach didn’t work), set up tickets, and added fake bookings to show the booking flow.

The result: five fully-formed events on the site, a new “Cooking” category, locations across London, and real bookings on each event — all from one prompt, in a few minutes.

We also showed the upcoming mobile app pulling up those same events in real time, including the ability to check in attendees directly from the app.

Try it yourself

Everything shown in the video is live in Events Manager 7.3. The AI / MCP Setup documentation walks through each step, including how to configure Claude Desktop, Cursor, VS Code, ChatGPT connectors, and more.

If you have questions or want to share what you build with it, drop us a note in the support forum.

The post Events Manager + AI (MCP) = ❤️ appeared first on Events Manager for WordPress.

A much smoother AI experience

When we introduced the MCP (Model Context Protocol) connector in 7.3, it authenticated using OAuth tokens. It worked, but in practice those tokens were prone to timing out mid-conversation — which is exactly the moment you don’t want your AI assistant losing its connection to your site.

So we’ve reworked the whole thing to use WordPress application passwords instead. They’re built into WordPress core, they don’t expire out from under you, and they’re far simpler to set up. The upshot is that connecting an AI agent to your events is now more reliable and a good deal less fiddly. If you tried the MCP connector when 7.3 landed and found it temperamental, this is the update that fixes that for you.

Pro users get a nice bonus here as well: your Pro features are now exposed to the MCP server too. That means an AI agent can work with custom booking forms, coupons, gateways and the rest through the same authenticated connection as the core features — no separate setup, it just appears once both plugins are up to date.

“Add a 20% early-bird coupon to my summer workshop and email me the booking link” — the kind of thing an assistant can now actually do end to end.

A growing REST API

We’ve also kept building out the REST API, which is the foundation everything else (including the AI layer) sits on top of:

• Featured images for events and locations, both reading and writing, plus a dedicated media upload endpoint.
• Event categories and tags now carry their colour and image through the API.
• Location geo-discovery endpoints — pull back the countries, regions, states and towns you actually have events in, rather than guessing.
• Smarter booking queries — you can now filter /bookings by location (country, region, state, town, or near a point) and by event date, so headless and integration setups can ask much more precise questions.

None of this is something you’ll trip over in day-to-day use, but if you’re building anything custom on top of Events Manager, there’s a lot more to work with now.

Calendar dots

On the front-end side, the calendar gets a new dots style. Instead of cramming event titles into each day, you can mark days with coloured dots — much tidier on busy months — and set a per-day limit so a single popular day doesn’t blow out your layout. It’s all there as a style choice in the Events Calendar block, so you can mix and match to taste.

More to come!

We have a lot in the pipeline, we’re excited to follow-up very soon with more announcements!

Changelog

Events Manager 7.3.3

• Added: Calendar “dots” style — events can now be marked with coloured dots instead of (or alongside) titles, with a style choice and a per-day event limit exposed in the Events Calendar block.
• Added: REST API support for featured images on events and locations (input and output), a media upload endpoint and ability, and term colour + image on event categories/tags.
• Added: Location geo-discovery REST endpoints (countries, regions, states, towns) and an upcoming_events_count field on the location response.
• Added: REST /bookings now accepts location filters (country/region/state/town/near) and a scope parameter to filter bookings by event date.
• Added: MCP get-booking-requirements now returns per-field validation metadata with country-tuned phone examples, so AI agents can pre-validate bookings.
• Tweaked: The recurring-booking calendar picker now respects the configured default calendar style.
• Tweaked: Improved the MCP experience for AI agents — authentication now uses WordPress application passwords instead of timeout-prone OAuth tokens, with native-app support, and the MCP server now exposes Pro and other add-on abilities alongside core’s.

Events Manager Pro 3.8.2

• Added: Pro abilities (custom forms, coupons, gateways and more) are now exposed on the Events Manager MCP server, so AI agents and headless clients can manage Pro bookings through the same authenticated surface as core.
• Tweaked: Improved the MCP experience — Pro now shares core’s WordPress application-password authentication instead of timeout-prone OAuth tokens, with leaner consent text.
• Fixed: Custom booking and attendee fields now expose validation metadata (with custom regex reconciled against the field type) through the booking-requirements API, so AI agents and headless clients can validate Pro fields before submitting.

The post Events Manager 7.3.3 and Pro 3.8.2 appeared first on Events Manager for WordPress.