Event Monster – Event Manager, Ticket Booking & Registration Security & Risk Analysis

The plugin "event-monster" v2.0.1 exhibits a mixed security posture. While it demonstrates some good practices such as a significant number of nonce and capability checks, and a majority of SQL queries utilizing prepared statements, there are notable areas of concern. The presence of 12 AJAX handlers without authentication checks presents a substantial attack surface. Furthermore, the taint analysis reveals 9 flows with unsanitized paths, including 6 of high severity, indicating potential vulnerabilities in how user input is processed. The plugin's history of 7 known CVEs, with 4 high and 3 medium severity, points to recurring security weaknesses across various categories, including XSS, SQL Injection, CSRF, and data exposure. The most recent vulnerability, dated January 2025, suggests that security issues have been persistent.

Overall, the plugin's security is compromised by its unprotected AJAX endpoints and the identified unsanitized data flows, which pose immediate risks. The historical prevalence of high and medium severity vulnerabilities, even with no currently unpatched CVEs, indicates a need for rigorous auditing and improved secure coding practices. While the plugin shows effort in areas like prepared statements and escaping, these strengths are overshadowed by the identified vulnerabilities and the large unprotected attack surface, making it a moderate to high risk for users.