Unknown WP Events Manager

• CVE-2026-15148 Medium 5.3 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR 0.2%
• CVE-2026-14205 Critical 9.8 WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter 0.5%