Vulnerabilities and security researches forrsvp rsvp

May 27, 2026

CVE, Research URL: CVE-2026-27398
Home page URL: Security reports for RSVP and Event Management Plugin
Application: RSVP and Event Management Plugin
Date: May 26, 2026
Research Description: Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RSVP and Event Management: from n/a through 2.7.16.
Affected versions: max 2.7.17.
Status: vulnerable

Apr 13, 2026

CVE, Research URL: CVE-2026-39536
Home page URL: Security reports for RSVP and Event Management Plugin
Application: RSVP and Event Management Plugin
Date: Apr 08, 2026
Research Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.
Affected versions: max 2.7.17.
Status: vulnerable

Jan 25, 2025

CVE, Research URL: CVE-2025-24683
Home page URL: Security reports for RSVP and Event Management Plugin
Application: RSVP and Event Management Plugin
Date: Jan 24, 2025
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill RSVP and Event Management Plugin allows SQL Injection. This issue affects RSVP and Event Management Plugin: from n/a through 2.7.14.
Affected versions: max 2.7.15.
Status: vulnerable

Jan 07, 2025

CVE, Research URL: CVE-2024-12711
Home page URL: Security reports for RSVP and Event Management Plugin
Application: RSVP and Event Management Plugin
Date: Jan 07, 2025
Research Description: The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.
Affected versions: max 2.7.14.
Status: vulnerable

Jun 06, 2024

CVE, Research URL: CVE-2017-18563
Home page URL: Security reports for RSVP and Event Management Plugin
Application: RSVP and Event Management Plugin
Date: Aug 21, 2019
Research Description: The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
Affected versions: max 2.3.8.
Status: vulnerable

CVE, Research URL: CVE-2022-1054
Home page URL: Security reports for RSVP and Event Management Plugin
Application: RSVP and Event Management Plugin
Date: Apr 18, 2022
Research Description: The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
Affected versions: max 2.7.5.
Status: vulnerable