The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
The events-manager plugin before 5.5 for WordPress has XSS via EMTicket::getpost.
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.