Is RSVP and Event Management safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (2.7.18). As of 2026-11-04. 6 issues are on record for older versions; version 2.7.17 or newer fixes all of them that state a fix. Keep RSVP and Event Management on the latest version (2.7.18) and remove it if you do not use it.

Which versions of RSVP and Event Management are vulnerable?

Known issues on record (newest first): Missing authorization check (2.7.16 and older, fixed in 2.7.17); Information disclosure (2.7.16 and older, fixed in 2.7.17); SQL injection (2.7.14 and older, fixed in 2.7.15); Missing authorization check (2.7.13 and older, fixed in 2.7.14); Missing authorization check (older than 2.7.8, fixed in 2.7.8); Cross-site scripting (XSS) (older than 2.3.8, fixed in 2.3.8). The full list with sources is on this page.

What is the latest version of RSVP and Event Management?

2.7.18, according to wordpress.org (last updated 2026-08-14). It has 3,000+ active installs.

What should I do if my RSVP and Event Management is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update rsvp). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · rsvp · data as of 2026-11-04

Is RSVP and Event Management safe? Known vulnerabilities and latest version

Latest version: 2.7.18
Last updated: 2026-08-14
Active installs: 3,000+
Known issues on record: 6
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 5.6+

Simple Event Registration & RSVP Management for WordPress — by WP Chill

What to do

Update to the latest version (2.7.18). Anything older than 2.7.17 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get rsvp --field=version shows what you run; wp plugin update rsvp updates it.

Check your version

Known vulnerabilities

6 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 5.3 CVE-2026-27398 · published 2026-05-25

Missing authorization check in RSVP and Event Management (2.7.16 and older)

Affected: 2.7.16 and older
Fixed in: 2.7.17
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RSVP and Event Management: from n/a through 2.7.16.

NVD CVE-2026-27398 Patchstack advisory

medium 5.3 CVE-2026-39536 · published 2026-04-08

Information disclosure in RSVP and Event Management (2.7.16 and older)

Affected: 2.7.16 and older
Fixed in: 2.7.17
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.

NVD CVE-2026-39536 Patchstack advisory

high 7.6 CVE-2025-24683 · published 2025-01-24

SQL injection in RSVP and Event Management (2.7.14 and older)

Affected: 2.7.14 and older
Fixed in: 2.7.15
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.

NVD CVE-2025-24683 Patchstack advisory

medium 5.3 CVE-2024-12711 · published 2025-01-07

Missing authorization check in RSVP and Event Management (2.7.13 and older)

Affected: 2.7.13 and older
Fixed in: 2.7.14 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.

NVD CVE-2024-12711 Wordfence advisory Code change (fix)

medium 5.3 CVE-2022-1054 · published 2022-04-18

Missing authorization check in RSVP and Event Management (older than 2.7.8)

Affected: older than 2.7.8
Fixed in: 2.7.8
Access needed (per CVSS): No login needed
Range from: advisory text · score by NVD

Details from the advisory

The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events

NVD CVE-2022-1054 WPScan advisory

medium 6.1 CVE-2017-18563 · published 2019-08-21

Cross-site scripting (XSS) in RSVP and Event Management (older than 2.3.8)

Affected: older than 2.3.8
Fixed in: 2.3.8
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.

NVD CVE-2017-18563 wordpress.org

Recent activity

2026-08-14 — latest release on wordpress.org (2.7.18).
2026-05-25 — Missing authorization check disclosed (CVE-2026-27398), fixed in 2.7.17.
2026-04-08 — Information disclosure disclosed (CVE-2026-39536), fixed in 2.7.17.
2025-01-24 — SQL injection disclosed (CVE-2025-24683), fixed in 2.7.15.

Free. We check the CVE feeds every day and email you only when a new issue for RSVP and Event Management (rsvp) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (3) · Sensitive data exposure (1) · SQL injection (1) · Cross-site scripting (XSS) (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/rsvp (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/rsvp"><img src="https://laskyr.com/plugins/rsvp/badge.svg" alt="RSVP and Event Management vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is RSVP and Event Management safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (2.7.18)

What to do

Check your version

Known vulnerabilities

Missing authorization check in RSVP and Event Management (2.7.16 and older)

Information disclosure in RSVP and Event Management (2.7.16 and older)

SQL injection in RSVP and Event Management (2.7.14 and older)

Missing authorization check in RSVP and Event Management (2.7.13 and older)

Missing authorization check in RSVP and Event Management (older than 2.7.8)

Cross-site scripting (XSS) in RSVP and Event Management (older than 2.3.8)

Recent activity

Get an email when RSVP and Event Management has a new vulnerability

Browse vulnerabilities

Where this data comes from