Events Manager – Calendar, Bookings, Tickets, and more!

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 36% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ iwmi-webmaster

   2mo ago

   Since version 7.3.5 the Block Editor no longer shows the WHEN metabox. It shows up within the List view as a locked block component and is broken. When we switch to the Classic Editor the editors can not format the posts using the proper blocks that they need to use. On existing events when using the block editor even if the WHEN metabox is enabled in Preferences it does not show anywhere, not even in the List view.

   Read on wp.org ↗
2. ★★★★★ laclickchic

   3mo ago

   I’ve tried lots of event plugins and this was by far the best. It ticked all the boxes for me. I wanted a comprehensive search bar, multiple viewing options and reoccurring events. The free version was a great way to get started but the pro is even better especially with the import/export capability. I found the tutorials, support pages and document really good. I’m using oceanwp theme with elementor and I haven’t had any issues.

   Read on wp.org ↗
3. ★★★★★ a2withkids

   3mo ago

   I have been using Events Manager since late 2015 and was so excited to hear it now offers blocks in place of shortcodes & is now offering Gutenberg to edit events. Thankfully I decided to test it out on my staging site first. I cannot publish events when I upgrade. It just saves them as drafts. I’ve tried turning off all other plugins & reverting to 2025 theme, and same behavior. Several years ago, I’d already figured out how to use REST settings to use Gutenberg in events, so maybe a conflict there, but I tried getting rid of that and it still didn’t work.But, that aside I also tested out the new Events List block and it’s got some limitations that make it a good first step, but I probably will have to stick with shortcodes.* Can’t set a custom scope. This rules out probably 90% of my use cases.* Can set a category filter, can’t use a Tag or search filter* The block includes an h3 heading that you can’t leave out – if you leave it blank, rather than skip a header it uses Events* If you don’t set an output format (advanced) rather than pull the format you have defined as a shortcode would, it pulls its own format. I haven’t looked to see if you can set this format somewhere.* in setting output format, you can set header and footer, which is interesting as that’s a deprecated feature in shortcodes due to security risk of malicious html. All in all, the block is a great start, but it needs some enhancements to replace a shortcode. And obviously being able to publish events help.

   Read on wp.org ↗
4. ★★★★★ MMZx

   3mo ago

   Something wrong with 7.3 version. It crashed the site. WP vers 7.0

   Read on wp.org ↗
5. ★★★★★ wannabewindsurfer

   3mo ago

   I’ve been using it Events Manager for many years, both the Pro and Free versions, but the latest Free (7.3) crashed my site when updated.

   Read on wp.org ↗
6. ★★★★★ willpom

   5mo ago

   In general EM & Pro is great. Extremely customizable even if you aren’t a developer but willing to use available resources. However Pro support can sometimes feel lacking. This topic was modified 1 month, 3 weeks ago by willpom.

   Read on wp.org ↗
7. ★★★★★ geekery

   5mo ago

   I paid 99€ for a license, but the license itself is not working — which means I was never able to actually use the plugin I paid for. After purchase, I tried to activate the license as instructed, but it simply would not work. Because of this, I couldn’t access or use the core functionality of the plugin at all. So the issue is not just minor bugs — the product is effectively unusable from the start. I spent a significant amount of time trying to troubleshoot this on my own. I checked my setup, tested different configurations, and made sure everything was entered correctly, but nothing solved the issue. The license just does not activate. I then tried to contact support through the available channels, but received no response whatsoever. Not even a confirmation that my request was received. This is especially frustrating because the problem is directly related to the license I paid for — something that should be handled quickly by support. At this point, I have paid 99€ for a product that I cannot use at all, and I have no way of getting help or resolving the issue. Very disappointing experience. I cannot recommend this plugin.

   Read on wp.org ↗
8. ★★★★★ devhop

   5mo ago

   The plugin is very powerful and flexible, but I ran into a critical issue with the calendar month picker when using a non-English locale (e.g. French). After an AJAX reload of the calendar, the selected month becomes incorrect (often resets to January). This happens because the JS code parses a localized string like “mai 2026” into a Date object, which is not reliable and breaks outside English environments. Root cause:The code relies on parsing the displayed month label instead of using the ISO value already available in the input (e.g. “2026-05”). Suggested fix:Use the raw value attribute instead of parsing localized text, for example: let rawValue = monthpicker.attr('value');if (rawValue && /^\d{4}-\d{2}$/.test(rawValue)) {fp.setDate(rawValue + '-01', false, 'Y-m-d');} This avoids locale issues and ensures consistent behavior across all languages. As a temporary workaround, I had to implement a MutationObserver-based fix on the frontend to reapply the correct date after each AJAX reload. I strongly recommend addressing this in the core plugin, as it affects international users and leads to incorrect calendar navigation. Otherwise, the plugin remains feature-rich and very useful.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 7.4.0.1 Fixed (in-dev): dbDelta warnings and malformed ALTER TABLE queries on upgrade for the new timeranges table due to blank lines in the CREATE TABLE definition Update notice for Pro users. 7.4.0.1
2. — Version 7.4 Added: a “check for the latest stable version” option that bypasses the staggered update rollout, plus an EM_AUTO_UPDATES constant to auto-install held-back versions Fixed: “_load_textdomain_just_in_time was called incor 7.4
3. — Version 7.3.7.4 Fixed: Critical error on front-end event pages for events with a location URL since 7.3.7 7.3.7.4
4. — Version 7.3.7.3 Added: webp as accepted upload image type Fixed: SQL syntax error affecting ticket counts due to unprepared SQL statement (props @joneiseman) 7.3.7.3
5. — Version 7.3.7 Added: Push notification framework for the upcoming Events Manager mobile app — device registration, per-notification-type controls, and a settings UI. Added: Block editor — Event Details canvas panel with tabbed When an 7.3.7
6. — Version 7.3.6 Added: EU right of withdrawal (Widerrufsbutton) — guests and registered users can now submit a statutory cancellation request directly from a booking confirmation email or the My Bookings page, fulfilling the § 356a BGB 7.3.6

44 disclosed vulnerabilities on record for this plugin, 1 still affects the current version.

1. Medium · 6.1 Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter ↗
   2026-08-24 CVE-2026-17089 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.0.1 Patched in 7.4.1
2. Medium · 6.6 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys ↗
   2026-08-24 CVE-2026-14280 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 7.3.7.4 Patched in 7.4
3. Medium · 5.3 Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters ↗
   2026-08-24 CVE-2026-10627 Missing Authorization Affects <= 7.4.0 Patched in 7.4.1
4. Medium · 6.5 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action ↗
   2026-08-24 CVE-2026-15023 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 7.4.0 Patched in 7.4.1
5. Medium · 6.5 Events Manager <= 7.4.0 - Authenticated (Subscriber+) SQL Injection ↗
   2026-08-10 CVE-2026-18057 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 7.4.0 Patched in 7.4.1
6. High · 7.3 Events Manager <= 7.4.0 - Unauthenticated Privilege Escalation ↗
   2026-08-10 CVE-2026-18366 Improper Privilege Management Affects <= 7.4.0 Patched in 7.4.1
7. High · 7.2 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-08-04 CVE-2026-66457 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.4.2 No patch available
8. Medium · 5.3 Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure ↗
   2026-07-30 CVE-2026-18050 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.3 Patched in 7.4
9. High · 8.1 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection ↗
   2026-07-08 CVE-2026-57713 Deserialization of Untrusted Data Affects <= 7.3.6 Patched in 7.3.7
10. High · 7.5 Events Manager <= 7.3.6 - Unauthenticated SQL Injection ↗
    2026-07-01 CVE-2026-12987 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 7.3.6 Patched in 7.3.7
11. Medium · 6.4 Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode ↗
    2025-12-17 CVE-2025-12976 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.2.2.1 Patched in 7.2.3
12. Medium · 4.3 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion ↗
    2025-12-11 CVE-2025-12407 Cross-Site Request Forgery (CSRF) Affects <= 7.2.2.2 Patched in 7.2.2.3
13. Medium · 5.3 Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure ↗
    2025-12-11 CVE-2025-12408 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.2.2.2 Patched in 7.2.2.3
14. Medium · 6.4 Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes ↗
    2025-07-09 CVE-2025-6976 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.6.4.4 Patched in 6.6.5
15. High · 7.5 Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter ↗
    2025-07-09 CVE-2025-6970 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.6.4.4 Patched in 6.6.5
16. Medium · 6.1 Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter ↗
    2025-07-09 CVE-2025-6975 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.6.4.4 Patched in 6.6.5
17. Medium · 5.3 Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.4.1 - Missing Authorization ↗
    2025-02-26 CVE-2025-1249 Missing Authorization Affects <= 6.6.4.1 Patched in 6.6.4.2
18. High · 7.5 Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter ↗
    2025-02-20 CVE-2024-11260 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.6.3 Patched in 6.6.4
19. Medium · 6.1 Events Manager <= 6.4.8 - Reflected Cross-Site Scripting ↗
    2024-06-28 CVE-2024-5889 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.4.8 Patched in 6.4.9
20. Medium · 6.4 Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes ↗
    2024-06-11 CVE-2024-3492 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.4.7.3 Patched in 6.4.8
21. Medium · 4.3 Events Manager <= 6.4.6.4 - Missing Authorization ↗
    2024-03-28 CVE-2024-30515 Missing Authorization Affects <= 6.4.6.4 Patched in 6.4.7
22. Medium · 4.3 Events Manager <= 6.4.7.1 - Cross-Site Request Forgery ↗
    2024-03-28 CVE-2024-30421 Cross-Site Request Forgery (CSRF) Affects <= 6.4.7.1 Patched in 6.4.7.2
23. Medium · 6.4 Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-03-27 CVE-2024-2111 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.4.7.1 Patched in 6.4.7.2
24. Medium · 4.3 Events Manager <= 6.4.7.1 - Cross-Site Request Forgery ↗
    2024-03-27 CVE-2024-2110 Cross-Site Request Forgery (CSRF) Affects <= 6.4.7.1 Patched in 6.4.7.2
25. Medium · 4.4 Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings ↗
    2024-02-28 CVE-2024-0614 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.4.6.4 Patched in 6.4.7
26. Medium · 6.1 Events Manager <= 6.4.5 - Reflected Cross-Site Scripting ↗
    2023-11-23 CVE-2023-48326 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.4.5 Patched in 6.4.6
27. High · 7.2 Events Manager <= 5.9.7.3 - Admin+ SQL Injection ↗
    2020-06-07 CVE-2020-35012 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.9.7.3 Patched in 5.9.8
28. Medium · 6.1 Events Manager <= 5.9.7.3 - Cross-Site Scripting ↗
    2020-06-07 CVE-2020-35037 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.7.3 Patched in 5.9.8
29. High · 7.1 Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection ↗
    2020-02-06 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects < 5.9.7.2 Patched in 5.9.7.2
30. Medium · 5.5 Events Manager <= 5.9.7.1 - CSV Injection ↗
    2020-02-05 Improper Input Validation Affects <= 5.9.7.1 Patched in 5.9.7.2
31. Medium · 6.4 Events Manager <= 5.9.5 - Authenticated Stored Cross-Site Scripting ↗
    2019-10-16 CVE-2019-16523 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.5 Patched in 5.9.6
32. Medium · 4.8 Events Manager <= 5.9.4 - Cross-Site Scripting ↗
    2018-07-18 CVE-2018-13137 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.4 Patched in 5.9.5
33. Medium · 5.4 Events Manager <= 5.8.1.3 - Stored Cross-Site Scripting ↗
    2018-04-27 CVE-2018-0576 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.9 Patched in 5.9
34. Medium · 6.4 Events Manager <= 5.8.1.1 - Cross-Site Scripting ↗
    2018-03-26 CVE-2018-9020 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.8.1.2 Patched in 5.8.1.2
35. Medium · 6.1 Events Manager <= 5.5.7.1 - Cross-Site Scripting ↗
    2015-08-10 CVE-2015-9297 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.6 Patched in 5.6
36. Critical · 9.8 Events Manager <= 5.5.7.1 - Code Injection ↗
    2015-08-10 CVE-2015-9298 Improper Control of Generation of Code ('Code Injection') Affects < 5.6 Patched in 5.6
37. Medium · 6.1 Events Manager < 5.5.7.1 - Cross-Site Scripting ↗
    2015-06-04 CVE-2015-9299 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.5.7.1 Patched in 5.5.7.1
38. Medium · 6.1 Events Manager < 5.5.7 - Cross-Site Scripting ↗
    2015-05-23 CVE-2015-9300 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.5.7 Patched in 5.5.7
39. Medium · 6.1 Events Manager < 5.3.5 & Events Manager Pro < 2.2.9 - Cross-Site Scripting ↗
    2014-08-01 CVE-2013-1407 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.3.5 Patched in 5.3.5
40. Medium · 6.1 Events Manager < 5.3.9 - Cross-Site Scripting ↗
    2014-08-01 CVE-2013-7479 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.3.9 Patched in 5.3.9
41. Medium · 6.1 Events Manager <= 5.5.1 - Multiple Cross-Site Scripting ↗
    2014-08-01 CVE-2013-7477 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.5.1 Patched in 5.5.2
42. Medium · 6.1 Events Manager < 5.5 - Cross-Site Scripting ↗
    2013-08-14 CVE-2013-7478 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.5 Patched in 5.5
43. Medium · 6.1 Events Manager <= 5.3.6 - Multiple Cross-Site Scripting ↗
    2013-02-27 CVE-2013-7480 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.3.6 Patched in 5.3.6.1
44. Medium · 6.1 Events Manager < 5.1.7 - Cross-Site Scripting ↗
    2012-05-22 CVE-2012-6716 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.1.7 Patched in 5.1.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 75 languages, 2 at 90% or more

Plus 51 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-10-11 80K+ → 70K+ down after 378 days in tier
2. 2024-09-28 90K+ → 80K+ down after 2 days in tier
3. 2024-09-26 80K+ → 90K+ up after 4 days in tier
4. 2024-09-22 90K+ → 80K+ down after 472 days in tier
5. 2023-06-08 100K+ → 90K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce 20K+ installs · 4.0★ · 3 shared tags A
• Events Calendar by FooEvents 4K+ installs · 3.8★ · 3 shared tags B
• The Events Calendar 600K+ installs · 4.2★ · 2 shared tags A
• WP Events Manager 30K+ installs · 3.3★ · 2 shared tags B
• WP Simple Booking Calendar 20K+ installs · 4.8★ · 2 shared tags A
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 10K+ installs · 4.6★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Events Manager – Calendar, Bookings, Tickets, and more! into a readme, a review or a deck. It updates itself.

Events Manager – Calendar, Bookings, Tickets, and more!: 70K+ active installs, 4.2★ (547 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/events-manager