Events Manager – Calendar, Bookings, Tickets, Appointments and more!

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

1820 searches this plugin appeared in over the last 90 days, 20 listed. 1615 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 36% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2 months ago and a band this size takes about a year or more to cross, so the real count is still just under 70K.

1. ★★★★★ iwmi-webmaster

   4mo ago

   Since version 7.3.5 the Block Editor no longer shows the WHEN metabox. It shows up within the List view as a locked block component and is broken. When we switch to the Classic Editor the editors can not format the posts using the proper blocks that they need to use. On existing events when using the block editor even if the WHEN metabox is enabled in Preferences it does not show anywhere, not even in the List view.

   Read on wp.org ↗
2. ★★★★★ laclickchic

   5mo ago

   I’ve tried lots of event plugins and this was by far the best. It ticked all the boxes for me. I wanted a comprehensive search bar, multiple viewing options and reoccurring events. The free version was a great way to get started but the pro is even better especially with the import/export capability. I found the tutorials, support pages and document really good. I’m using oceanwp theme with elementor and I haven’t had any issues.

   Read on wp.org ↗
3. ★★★★★ a2withkids

   5mo ago

   I have been using Events Manager since late 2015 and was so excited to hear it now offers blocks in place of shortcodes & is now offering Gutenberg to edit events. Thankfully I decided to test it out on my staging site first. I cannot publish events when I upgrade. It just saves them as drafts. I’ve tried turning off all other plugins & reverting to 2025 theme, and same behavior. Several years ago, I’d already figured out how to use REST settings to use Gutenberg in events, so maybe a conflict there, but I tried getting rid of that and it still didn’t work.But, that aside I also tested out the new Events List block and it’s got some limitations that make it a good first step, but I probably will have to stick with shortcodes.* Can’t set a custom scope. This rules out probably 90% of my use cases.* Can set a category filter, can’t use a Tag or search filter* The block includes an h3 heading that you can’t leave out – if you leave it blank, rather than skip a header it uses Events* If you don’t set an output format (advanced) rather than pull the format you have defined as a shortcode would, it pulls its own format. I haven’t looked to see if you can set this format somewhere.* in setting output format, you can set header and footer, which is interesting as that’s a deprecated feature in shortcodes due to security risk of malicious html. All in all, the block is a great start, but it needs some enhancements to replace a shortcode. And obviously being able to publish events help.

   Read on wp.org ↗
4. ★★★★★ MMZx

   5mo ago

   Something wrong with 7.3 version. It crashed the site. WP vers 7.0

   Read on wp.org ↗
5. ★★★★★ wannabewindsurfer

   5mo ago

   I’ve been using it Events Manager for many years, both the Pro and Free versions, but the latest Free (7.3) crashed my site when updated.

   Read on wp.org ↗
6. ★★★★★ willpom

   7mo ago

   In general EM & Pro is great. Extremely customizable even if you aren’t a developer but willing to use available resources. However Pro support can sometimes feel lacking. This topic was modified 1 month, 3 weeks ago by willpom.

   Read on wp.org ↗
7. ★★★★★ geekery

   7mo ago

   I paid 99€ for a license, but the license itself is not working — which means I was never able to actually use the plugin I paid for. After purchase, I tried to activate the license as instructed, but it simply would not work. Because of this, I couldn’t access or use the core functionality of the plugin at all. So the issue is not just minor bugs — the product is effectively unusable from the start. I spent a significant amount of time trying to troubleshoot this on my own. I checked my setup, tested different configurations, and made sure everything was entered correctly, but nothing solved the issue. The license just does not activate. I then tried to contact support through the available channels, but received no response whatsoever. Not even a confirmation that my request was received. This is especially frustrating because the problem is directly related to the license I paid for — something that should be handled quickly by support. At this point, I have paid 99€ for a product that I cannot use at all, and I have no way of getting help or resolving the issue. Very disappointing experience. I cannot recommend this plugin.

   Read on wp.org ↗
8. ★★★★★ devhop

   8mo ago

   The plugin is very powerful and flexible, but I ran into a critical issue with the calendar month picker when using a non-English locale (e.g. French). After an AJAX reload of the calendar, the selected month becomes incorrect (often resets to January). This happens because the JS code parses a localized string like “mai 2026” into a Date object, which is not reliable and breaks outside English environments. Root cause:The code relies on parsing the displayed month label instead of using the ISO value already available in the input (e.g. “2026-05”). Suggested fix:Use the raw value attribute instead of parsing localized text, for example: let rawValue = monthpicker.attr('value');if (rawValue && /^\d{4}-\d{2}$/.test(rawValue)) {fp.setDate(rawValue + '-01', false, 'Y-m-d');} This avoids locale issues and ensures consistent behavior across all languages. As a temporary workaround, I had to implement a MutationObserver-based fix on the frontend to reapply the correct date after each AJAX reload. I strongly recommend addressing this in the core plugin, as it affects international users and leads to incorrect calendar navigation. Otherwise, the plugin remains feature-rich and very useful.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 7.4.0.1 Fixed (in-dev): dbDelta warnings and malformed ALTER TABLE queries on upgrade for the new timeranges table due to blank lines in the CREATE TABLE definition Update notice for Pro users. 7.4.0.1
2. — Version 7.4 Added: a “check for the latest stable version” option that bypasses the staggered update rollout, plus an EM_AUTO_UPDATES constant to auto-install held-back versions Fixed: “_load_textdomain_just_in_time was called incor 7.4
3. — Version 7.3.7.4 Added: Stable update checking options, excluded from automatic background updates Moved update checks into em-updates.php so the auto-update veto loads during cron 7.3.7.4
4. — Version 7.3.7.3 Added: webp as accepted upload image type Fixed: SQL syntax error affecting ticket counts due to unprepared SQL statement (props @joneiseman) 7.3.7.3
5. — Version 7.3.7 Added: Push notification framework for the upcoming Events Manager mobile app — device registration, per-notification-type controls, and a settings UI. Added: Block editor — Event Details canvas panel with tabbed When an 7.3.7
6. — Version 7.3.6 Added: EU right of withdrawal (Widerrufsbutton) — guests and registered users can now submit a statutory cancellation request directly from a booking confirmation email or the My Bookings page, fulfilling the § 356a BGB 7.3.6

1 open vulnerability affects the current version (7.4.12). 50 of 51 disclosed are patched.

1. Patched Medium · 6.1 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Reflected Cross-Site Scripting ↗
   2026-10-22 CVE-2026-114694 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.8 Patched in 7.4.9
2. Open Medium · 5.3 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Race Condition ↗
   2026-10-12 CVE-2026-42689 Concurrent Execution using Shared Resource with Improper Synchronization Affects <= 7.4.8 No patch available
3. Patched Medium · 6.5 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection ↗
   2026-10-06 CVE-2026-42633 Improper Neutralization of Special Elements used in an SQL Command Affects <= 7.4.6 Patched in 7.4.7
4. Patched Medium · 5.3 Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure ↗
   2026-10-05 CVE-2026-105068 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.4.5 Patched in 7.4.6
5. Patched Medium · 4.3 Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure ↗
   2026-09-22 CVE-2026-93662 Exposure of Sensitive Information to an Unauthorized Actor Affects 7.4.1 - 7.4.4 Patched in 7.4.5
6. Patched Medium · 4.3 Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference ↗
   2026-09-22 CVE-2026-93661 Authorization Bypass Through User-Controlled Key Affects <= 7.4.4 Patched in 7.4.5
7. Patched Medium · 5.4 Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes ↗
   2026-09-04 CVE-2025-14945 Improper Neutralization of Input During Web Page Generation Affects <= 7.3.3 Patched in 7.3.4
8. Patched Medium · 6.1 Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter ↗
   2026-08-24 CVE-2026-17089 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.0.1 Patched in 7.4.1
9. Patched Medium · 6.6 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys ↗
   2026-08-24 CVE-2026-14280 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 7.3.7.4 Patched in 7.4
10. Patched Medium · 5.3 Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters ↗
    2026-08-24 CVE-2026-10627 Missing Authorization Affects <= 7.4.0 Patched in 7.4.1
11. Patched Medium · 6.5 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action ↗
    2026-08-24 CVE-2026-15023 Improper Neutralization of Special Elements used in an SQL Command Affects <= 7.4.0 Patched in 7.4.1
12. Patched Medium · 6.5 Events Manager <= 7.4.0 - Authenticated (Subscriber+) SQL Injection ↗
    2026-08-10 CVE-2026-18057 Improper Neutralization of Special Elements used in an SQL Command Affects <= 7.4.0 Patched in 7.4.1
13. Patched High · 7.3 Events Manager <= 7.4.0 - Unauthenticated Privilege Escalation ↗
    2026-08-10 CVE-2026-18366 Improper Privilege Management Affects <= 7.4.0 Patched in 7.4.1
14. Patched High · 7.2 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-08-04 CVE-2026-66457 Improper Neutralization of Input During Web Page Generation Affects <= 7.4.2 Patched in 7.4.3
15. Patched Medium · 5.3 Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure ↗
    2026-07-30 CVE-2026-18050 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.3 Patched in 7.4
16. Patched High · 8.1 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection ↗
    2026-07-08 CVE-2026-57713 Deserialization of Untrusted Data Affects <= 7.3.6 Patched in 7.3.7
17. Patched High · 7.5 Events Manager <= 7.3.6 - Unauthenticated SQL Injection ↗
    2026-07-01 CVE-2026-12987 Improper Neutralization of Special Elements used in an SQL Command Affects <= 7.3.6 Patched in 7.3.7
18. Patched Medium · 6.4 Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode ↗
    2025-12-17 CVE-2025-12976 Improper Neutralization of Input During Web Page Generation Affects <= 7.2.2.1 Patched in 7.2.3
19. Patched Medium · 4.3 Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion ↗
    2025-12-11 CVE-2025-12407 Cross-Site Request Forgery Affects <= 7.2.2.2 Patched in 7.2.2.3
20. Patched Medium · 5.3 Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure ↗
    2025-12-11 CVE-2025-12408 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.2.2.2 Patched in 7.2.2.3
21. Patched Medium · 6.4 Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes ↗
    2025-07-09 CVE-2025-6976 Improper Neutralization of Input During Web Page Generation Affects <= 6.6.4.4 Patched in 6.6.5
22. Patched High · 7.5 Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter ↗
    2025-07-09 CVE-2025-6970 Improper Neutralization of Special Elements used in an SQL Command Affects <= 6.6.4.4 Patched in 6.6.5
23. Patched Medium · 6.1 Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter ↗
    2025-07-09 CVE-2025-6975 Improper Neutralization of Input During Web Page Generation Affects <= 6.6.4.4 Patched in 6.6.5
24. Patched Medium · 5.3 Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.4.1 - Missing Authorization ↗
    2025-02-26 CVE-2025-1249 Missing Authorization Affects <= 6.6.4.1 Patched in 6.6.4.2
25. Patched High · 7.5 Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter ↗
    2025-02-20 CVE-2024-11260 Improper Neutralization of Special Elements used in an SQL Command Affects <= 6.6.3 Patched in 6.6.4
26. Patched Medium · 6.1 Events Manager <= 6.4.8 - Reflected Cross-Site Scripting ↗
    2024-06-28 CVE-2024-5889 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.8 Patched in 6.4.9
27. Patched Medium · 6.4 Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes ↗
    2024-06-11 CVE-2024-3492 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.7.3 Patched in 6.4.8
28. Patched Medium · 4.3 Events Manager <= 6.4.6.4 - Missing Authorization ↗
    2024-03-28 CVE-2024-30515 Missing Authorization Affects <= 6.4.6.4 Patched in 6.4.7
29. Patched Medium · 4.3 Events Manager <= 6.4.7.1 - Cross-Site Request Forgery ↗
    2024-03-28 CVE-2024-30421 Cross-Site Request Forgery Affects <= 6.4.7.1 Patched in 6.4.7.2
30. Patched Medium · 6.4 Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-03-27 CVE-2024-2111 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.7.1 Patched in 6.4.7.2
31. Patched Medium · 4.3 Events Manager <= 6.4.7.1 - Cross-Site Request Forgery ↗
    2024-03-27 CVE-2024-2110 Cross-Site Request Forgery Affects <= 6.4.7.1 Patched in 6.4.7.2
32. Patched Medium · 4.4 Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings ↗
    2024-02-28 CVE-2024-0614 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.6.4 Patched in 6.4.7
33. Patched Medium · 6.1 Events Manager <= 6.4.5 - Reflected Cross-Site Scripting ↗
    2023-11-23 CVE-2023-48326 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.5 Patched in 6.4.6
34. Patched High · 7.2 Events Manager <= 5.9.7.3 - Admin+ SQL Injection ↗
    2020-06-07 CVE-2020-35012 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.9.7.3 Patched in 5.9.8
35. Patched Medium · 6.1 Events Manager <= 5.9.7.3 - Cross-Site Scripting ↗
    2020-06-07 CVE-2020-35037 Improper Neutralization of Input During Web Page Generation Affects <= 5.9.7.3 Patched in 5.9.8
36. Patched High · 7.1 Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection ↗
    2020-02-06 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects < 5.9.7.2 Patched in 5.9.7.2
37. Patched Medium · 5.5 Events Manager <= 5.9.7.1 - CSV Injection ↗
    2020-02-05 Improper Input Validation Affects <= 5.9.7.1 Patched in 5.9.7.2
38. Patched Medium · 6.4 Events Manager <= 5.9.5 - Authenticated Stored Cross-Site Scripting ↗
    2019-10-16 CVE-2019-16523 Improper Neutralization of Input During Web Page Generation Affects <= 5.9.5 Patched in 5.9.6
39. Patched Medium · 4.8 Events Manager <= 5.9.4 - Cross-Site Scripting ↗
    2018-07-18 CVE-2018-13137 Improper Neutralization of Input During Web Page Generation Affects <= 5.9.4 Patched in 5.9.5
40. Patched Medium · 5.4 Events Manager <= 5.8.1.3 - Stored Cross-Site Scripting ↗
    2018-04-27 CVE-2018-0576 Improper Neutralization of Input During Web Page Generation Affects < 5.9 Patched in 5.9
41. Patched Medium · 6.4 Events Manager <= 5.8.1.1 - Cross-Site Scripting ↗
    2018-03-26 CVE-2018-9020 Improper Neutralization of Input During Web Page Generation Affects < 5.8.1.2 Patched in 5.8.1.2
42. Patched Medium · 6.1 Events Manager <= 5.5.7.1 - Cross-Site Scripting ↗
    2015-08-10 CVE-2015-9297 Improper Neutralization of Input During Web Page Generation Affects < 5.6 Patched in 5.6
43. Patched Critical · 9.8 Events Manager <= 5.5.7.1 - Code Injection ↗
    2015-08-10 CVE-2015-9298 Improper Control of Generation of Code Affects < 5.6 Patched in 5.6
44. Patched Medium · 6.1 Events Manager < 5.5.7.1 - Cross-Site Scripting ↗
    2015-06-04 CVE-2015-9299 Improper Neutralization of Input During Web Page Generation Affects < 5.5.7.1 Patched in 5.5.7.1
45. Patched Medium · 6.1 Events Manager < 5.5.7 - Cross-Site Scripting ↗
    2015-05-23 CVE-2015-9300 Improper Neutralization of Input During Web Page Generation Affects < 5.5.7 Patched in 5.5.7
46. Patched Medium · 6.1 Events Manager < 5.3.5 & Events Manager Pro < 2.2.9 - Cross-Site Scripting ↗
    2014-08-01 CVE-2013-1407 Improper Neutralization of Input During Web Page Generation Affects < 5.3.5 Patched in 5.3.5
47. Patched Medium · 6.1 Events Manager < 5.3.9 - Cross-Site Scripting ↗
    2014-08-01 CVE-2013-7479 Improper Neutralization of Input During Web Page Generation Affects < 5.3.9 Patched in 5.3.9
48. Patched Medium · 6.1 Events Manager <= 5.5.1 - Multiple Cross-Site Scripting ↗
    2014-08-01 CVE-2013-7477 Improper Neutralization of Input During Web Page Generation Affects <= 5.5.1 Patched in 5.5.2
49. Patched Medium · 6.1 Events Manager < 5.5 - Cross-Site Scripting ↗
    2013-08-14 CVE-2013-7478 Improper Neutralization of Input During Web Page Generation Affects < 5.5 Patched in 5.5
50. Patched Medium · 6.1 Events Manager <= 5.3.6 - Multiple Cross-Site Scripting ↗
    2013-02-27 CVE-2013-7480 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.6 Patched in 5.3.6.1
51. Patched Medium · 6.1 Events Manager < 5.1.7 - Cross-Site Scripting ↗
    2012-05-22 CVE-2012-6716 Improper Neutralization of Input During Web Page Generation Affects < 5.1.7 Patched in 5.1.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 76 languages, 2 at 90% or more

Plus 52 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-08-26 70K+ → 60K+ down after 319 days in tier
2. 2025-10-11 80K+ → 70K+ down after 378 days in tier
3. 2024-09-28 90K+ → 80K+ down after 2 days in tier
4. 2024-09-26 80K+ → 90K+ up after 4 days in tier
5. 2024-09-22 90K+ → 80K+ down after 472 days in tier
6. 2023-06-08 100K+ → 90K+ down after 2929 days in tier
7. 2015-06-01 70K+ → 100K+ up after 5 days in tier
8. 2015-05-27 100K+ → 70K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Events Manager – Calendar, Bookings, Tickets, Appointments and more! into a readme, a review or a deck. It updates itself.

Events Manager – Calendar, Bookings, Tickets, Appointments and more!: 60K+ active installs, 4.2★ (551 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/events-manager