Roundupwp's vulnerability profile centers on a specialized WordPress plugin for event management, where the exposure concentrates in input-handling weaknesses such as cross-site scripting and SQL injection. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, reflecting the web-application attack surface and the plugin's direct handling of user-supplied event data. Defenders should prioritize patching this plugin on WordPress instances that rely on it and monitor for exploitation in active environments; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Roundupwp over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-24943CRITICAL The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both un | Dec 6, 2021 | 9.8 | 42 | NO | YES |
CVE-2021-24876MEDIUM The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site | Nov 29, 2021 | 6.1 | 30 | NO | YES |
CVE-2024-7982CRITICAL The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthe | Nov 8, 2024 | 9.6 | 26 | NO | NO |
CVE-2024-39638HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roundup WP Registrations for the Events Calendar allows SQL Injection.This iss | Aug 29, 2024 | 8.8 | 25 | NO | NO |
CVE-2021-25083MEDIUM The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading | Jan 24, 2022 | 6.1 | 22 | NO | NO |
CVE-2024-10703MEDIUM The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to | Mar 25, 2025 | 6.1 | 18 | NO | NO |
CVE-2024-43143MEDIUM Missing Authorization vulnerability in Roundup WP Registrations for the Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects R | Nov 1, 2024 | 6.4 | 18 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Roundupwp.
Media articles that mention a CVE ID that affects a product developed by Roundupwp — matched by CVE ID, not by vendor name.