CVE-2025-39481

WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability

Critical9.3EPSS 0.55%

Published: 16 May 2025
Updated: 28 Apr 2026
Reserved: 16 Apr 2025
Assigned by: Patchstack

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through < 3.11.4.

Scores

CVSS scores of CVE-2025-39481, by who scored it
Scored by	CVSS	Score	Vector
PatchstackCNA (assigner)	3.1	Critical9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
NVDNVD · Modified	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.55% · top 54% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

imithemes · Eventer
- affected ≤ 3.11.4

References (1)

https://patchstack.com/database/Wordpress/Plugin/eventer/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-6-sql-injection-vulnerability?_s_id=cve (opens in a new tab)vdb-entry

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-39481](https://trackcve.app/badge/CVE-2025-39481.svg)](https://trackcve.app/cve/CVE-2025-39481)

Record last updated 28 Apr 2026, 16:12 UTC.