Free Plugin Plugin

Eventonomy

Most WordPress event plugins slow down as the calendar grows and pile on per-ticket fees. Eventonomy runs unlimited events, RSVPs with waitlists, recurring series, and four calendar views on custom tables. Free forever, your attendee data stays put.

7 releases

v1.5.0 latest

August 18, 2026 shipped

View product → View on store

v1.5.0 Latest

August 18, 2026

New 1 Improve 4 Fix 10 Dev 3 Compat 1

New

`wp eventonomy orphans --catalog` reports venue and organizer records nothing uses, and removes the ones demo data or an import left behind. Records with no known origin are listed but kept unless you add --catalog-untagged, because an unused venue may be one you added for a future event.

Improve

Every enabled event view stays reachable on a phone. With Week and Day added by Pro the selector needed more room than a 320px screen has, so Week was cut off and Day could not be reached at all; the selector now wraps.
The ticket quantity buttons keep their full size, and take the larger 44px touch target on phones. They were collapsing to as little as 21px, which made the main purchase control hard to tap.
Organizer and venue search finds records by the words people actually type.
Event and admin screens carry more translatable strings, and an event card can now be restyled from a theme without copying the whole archive template.

Fix

Picking a saved venue or organizer now works at normal clicking speed. The list of matches closed a fraction of a second after the pointer went down, so any click slower than an instant - a deliberate one, one with a little drag in it, or a slow tap on a phone - selected nothing at all and left the fields empty with no message. The same list can now also be reached with the keyboard.
Removing demo data now removes every demo event, instead of leaving most of them on the site to build up with each demo load.
Removing demo data no longer takes your own registration questions or the Custom questions setting with it. Only the questions the demo added are removed, and the setting stays on while you still have questions of your own.
Removing demo data now clears the venues and organizers it created, instead of leaving them behind to accumulate and be duplicated by the next demo load.
Clear all now clears the tag filter. Clearing filters after following a tag left the tag applied, so the results stayed narrowed and the tag label stayed on screen.
An event no longer shows an empty Availability row. The row appeared with nothing in it whenever remaining spots were kept private, which is the default.
Saving an event whose ticket details are incomplete no longer creates a second copy of the event when you fix the ticket and save again.
A booking fee the organizer absorbs is no longer listed to the buyer as a charge. It appeared as a line item while being left out of the total, so the figures did not add up.
Pending database updates now complete even when a previous update was interrupted partway.
Share links, the duplicate save notice and the search field label on the events archive.

Dev

The events endpoint returns times in UTC as well, so a client never has to infer the instant from a wall clock and a timezone name.
Event visibility is extensible: a host plugin can widen which visibility levels a viewer may see, and the same gate now applies to every listing surface rather than just the REST endpoint.
Release packaging clears the build directory first, so a block removed from the source can no longer ship from a stale build.

Compat

Aligned with Eventonomy Pro 1.5.0. Update both together.

v1.4.1

August 11, 2026

New 1 Improve 2 Fix 9 Dev 2 Compat 1

New

Members can cancel an RSVP straight from the Attending list in their dashboard, without opening the event.

Improve

Turning on Custom questions now reveals the question builder immediately, instead of leaving the section unchanged until the page was saved and reloaded.
A guest who RSVPs is now recognised by their email, which reaches the member who owns it or creates the account that will, so an account-less registration is still reachable later.

Fix

A guest who RSVPs now receives a private link in their confirmation email to view, change or cancel their RSVP. The link was only ever offered by a button that disappeared the moment the RSVP form was replaced by the confirmation.
The Attending list showed the same event several times when a member held more than one registration row for it. Each event now appears once, and duplicate rows left by older versions are cleaned up on update.
Publishing an event with a missing title or date no longer fails silently. The editor was throwing a script error on the validation response and showing nothing, so the form appeared to do nothing.
An abandoned checkout no longer holds seats forever. A buyer sent to the payment page who never returned left a pending order reserving stock, so enough abandoned carts made an event read "full" while tickets remained. Pending orders older than an hour are now cancelled and their seats released.
An event reports "full" as a fact, and "spots left" counts only seats a buyer can actually get, so the number beside the button and the button now agree.
Checkout asks for a name and email once, and no longer labels the ticket form an invoice.
The share menu on an event with a short description is no longer clipped, RSVP choice buttons take the theme's active-state styling, and remaining en and em dashes were removed from visible copy.
An event taking place right now is no longer missing from the events list; it stays listed until it actually ends.
Three admin-layout defects that shared one root cause were corrected.

Dev

wp eventonomy can repair an event left with no owner that nobody could edit, and reassign ownerless events.
New filter evnm_pending_order_ttl_minutes sets how long a pending order may hold its seats (0 disables the sweep), and evnm_release_stale_pending_order can exempt an order for an offline-payment workflow.

Compat

Aligned with Eventonomy Pro 1.4.1. Update both together.

v1.4.0

August 1, 2026

New 13 Improve 8 Fix 47 Security 3 Dev 8 Compat 1

New

Members can sign in to the mobile app with the WordPress password they already have, instead of being sent to a raw password screen.
A refunded or cancelled order now emails the buyer, saying what happened to their money and that the tickets will no longer admit them. Previously a refund reached them only as a bank line days later.
Settings -> RSVP gains "New events start as", so a site that mostly posts announcements no longer opens every new event on a registration form.
Each event chooses which of your registration questions it asks, using a picker in the event editor fed by your site-wide question bank.
Venues and Organizers can be created directly on their own admin screens, instead of only appearing as a side effect of typing them into an event.
Bulk actions on the Events list: publish, move to draft, cancel or delete permanently across a whole selection.
A Reported events screen gives you a real queue of reported events with the reason, the reporter and a Resolve or Re-open action, replacing an email that went nowhere.
A stopped or stalled import now says so, shows which row it died at, and offers a one-click resume that skips everything already imported.
The Command Center flags that sample data is still loaded, so demo events cannot quietly advertise themselves to your visitors.
Sample data now demonstrates every shape of event, including an announcement, an event registering elsewhere, an online event, a recurring series, a draft, a pending submission, two ticket types, a sold-out event and one asking custom questions.
Checkout now says an account will be created for the address given, instead of creating one silently.
Checkout now asks for a name and email only. Sites that issue tax invoices can switch on full invoice details, which add the address, company and tax number. Previously every site asked for eleven fields and marked seven required.
Payment methods are now chosen in settings rather than appearing on their own. A gateway shows at checkout only when you both configure it and switch it on, so keys pasted while testing no longer start taking money. Existing sites keep whatever they were already using.

Improve

The setup wizard now runs to the end and can be re-run: loading sample data no longer ends it early, and a completed setup offers a "Re-run setup wizard" button that changes nothing.
The event editor is one form again, with a single field width, one label style and real spacing between fields on both the admin and the frontend.
The event editor offers both outcomes at once: Publish event beside Save draft while you are still preparing, and Update event beside Switch to draft once it is live. Putting an event live no longer means finding a status field further down the form, and pulling a live event back to draft is now a single button.
Admin figures and alerts now open the screen they promise: a revenue figure opens Orders, "Connect a gateway" opens the Money tab, and "View public calendar" opens the calendar.
Attendee blasts and cancellation notices dispatch once per batch instead of once per recipient, so a 2,000-attendee event no longer takes thousands of separate sends.
Event dates on cards now show the event's own time zone while grouping by your site's zone, with the zone abbreviation shown only when the two actually differ.
wp eventonomy orphans now also reports events left with no owner, and can reassign them with --reassign-events.
Buyers no longer see the word "WooCommerce". Paying through your site's own checkout is presented as exactly that, and when it is switched on it is the only method offered, since it already provides whatever methods you set up there, including Stripe or PayPal.

Fix

With approval required, every event imported from WP-CLI was sent to the moderation queue, because a command line has no logged-in user to check permissions against. Imports now run as the administrator by default, say which account they used, and still respect approval when you point them at a member with --user.
A ticket with no capacity set could never be sold: every purchase was refused with "just sold out", while the ticket still displayed as available. This affected any ticket left without a limit, which is the normal setting for a donation.
A buyer with no account was sent to a login wall after paying, instead of their confirmation. Paid checkout creates an account but does not sign anyone in, so returning from the payment page was exactly the moment they had no session. They now land on their own order page, with the event details and their tickets.
The order page reachable without an account now carries the event date, the tickets themselves and the check-in code, rather than only an order number and a total.
The confirmation email now links every buyer back to their order and tickets, not just a buyer with no account. Because checkout creates an account, that link was reaching almost nobody, leaving buyers who closed the tab with no way back to their check-in code and no password to sign in with.
A fatal error could take a site down when the same class file was loaded twice, because the fallback autoloader re-included files instead of loading them once.
Donations added at checkout were not charged. The buyer chose an amount and saw it in the summary, but the order was created without it, so the site never received the money. Affected every site running Pro; sites on the free plan were always correct.
An event could sell more tickets than its stated capacity. Capacity limited free RSVPs but not ticket sales, even though both count toward the same total, so an event set to 25 could sell 40 and the "spots left" figure would reach zero and keep selling. Ticket sales now stop at the event's capacity, and the buyer is told how many places remain. Events with no capacity set are unaffected.
Required billing details are now enforced when the order is placed. The asterisks were previously decoration: an order could be submitted with none of them filled in.
Opening an event no longer greets visitors with a billing address form. Buyer and billing fields now appear once a ticket is chosen, matching the coupon, payment and total sections beside them, which already waited.
Buyers whose account was created for them at checkout are now offered a password, so they can sign in later. The offer stops once they set one.
A second order from an address that already has an account was refused with "please log in" and no way to do so, because the password from the first order was never sent. That refusal now carries a link to set a password.
A refunded order still said "You're registered" and showed a ticket that looked scannable. It now says the order was refunded and shows no ticket.
A buyer taking several seats saw their own name on every ticket. Extra seats now read "Guest of <name>", on both the order page and the member dashboard.
Quantity boxes on the ticket picker clipped the number, so the count was unreadable.
Paid tickets on a site with no payment method connected offered a working quantity picker that could never complete. They now show the price and read "Not on sale", while free tickets on the same event still work.
The event editor now says up front that paid tickets cannot be sold until a payment method is connected. That warning previously appeared only in the admin dashboard, which a member creating an event from the front end never sees.
The notice explaining that paid tickets cannot be bought appeared below the prices; it now appears above them.
Suggested donation amounts printed the raw setting, "10,25,50", instead of formatted money.
Remaining capacity was printed three times on a single event page, and the going count twice.
A refund policy was shown on free RSVP confirmations, where no money had changed hands.
Buying more than one seat admitted only one person: an order for three seats charged for three, sold three and created a single attendee, so the rest were turned away at the door.
Event times ended in "+00:00" on a site that had not chosen a city in Settings -> General, which is how WordPress ships. Times now read "UTC", or "UTC+5:30" for a half-hour offset, and a named zone still shows its own abbreviation.
Order confirmation emails for paid tickets arrived without the add-to-calendar links that free registrations already carried.
Three Settings options did nothing on a default install: Events per page, comments on event pages, and the events-list default layout.
Members told their event was cancelled, that their submission was declined, or that they had come off the waitlist got a correct message followed by the meaningless line "You have a new notification".
Saving one Settings tab silently switched off every checkbox on the other tabs; a site could lose its Display, Notifications, Permalinks, Mobile and Advanced toggles in one unrelated save.
Edits on the Questions tab were silently reverted to the stored value every time you saved.
An event created without an owner locked its own creator out of it, showing an empty form with no Update and no Delete.
Picking a saved venue filled in only its name and address, leaving city and country blank and writing the incomplete venue back on the next save.
Join URL and online instructions were asked for on every in-person event; they now appear only when the event is marked online.
Cancelling an attendee promoted someone off the waitlist, and emailed them, on events set to take no registrations.
An event that unticked a required question could take no registrations at all, rejecting every RSVP for a field its form never showed.
Tags assigned to an event never appeared anywhere; they now render as linked chips on the event page and can be browsed and filtered like categories.
Money was printed to two decimal places regardless of currency, so stores using a three-decimal currency saw exported and displayed amounts that disagreed with their own records.
Several lists silently stopped at 100 rows: a member with 12 or fewer saved events saw an empty Saved tab, order confirmations dropped every ticket past the 50th, and add-to-calendar links came out empty deep into a long series.
Date chips and category pills on event cards were unreadable in dark mode, rendering near-white text on a near-white plate.
Eventonomy's own admin notices were being swept off Eventonomy's own screens by the third-party notice suppression.
A validation error with no matching field was dropped entirely, leaving "Please fix the highlighted fields" above a form with nothing highlighted.
The event editor drew four nested boxes around a single form, and repeated the screen title as a second heading.
Browse views registered by an add-on had no pretty URL, so /events/week/ redirected to an unrelated page and /events/day/ returned a 404.
Hidden Eventonomy screens showed a blank browser tab title.
Imported and calendar-synced events opened Eventonomy's own registration form, so an event that was really filling up elsewhere showed zero attendees here and visitors could register somewhere the organizer never checks. An imported event now points at the source when it knows where registration lives, and otherwise takes no registrations.
A failed "Load more" quietly hid the button, which reads as having reached the end of the list; it now stays put and says what went wrong.
Changing an attendee's status showed a red box with no reason, sending the server's explanation to the browser console instead of the screen.
Error messages and the delete button were unreadable in dark mode, painting a colour chosen for white onto a near-black surface.
Several error messages could not be translated: the wording lived in the browser code rather than in the plugin's translation file, so a non-English site always saw English.

Security

An unauthenticated order request created a WordPress account before the request could be refused, so a checkout that always failed still left a real user behind. The account is now created only once the order succeeds.
Published events set to private were visible to logged-out visitors in the browse and upcoming lists, even though the API correctly hid them.
The registration mode is now enforced on every write path: a member, or a guest holding a magic link, could previously move their own response to Going on an event whose owner had said it takes no registrations.

Dev

New evnm_event_registration_questions() resolves which questions an event asks; an event with no stored selection asks the whole bank, an explicitly empty selection asks nothing.
New evnm_browse_views filter is the single list behind the rewrite rules, the view resolver, the switcher and the settings.
New evnm_reminder_notification filter and a phone field on the recipient row let a second channel add to a reminder instead of rebuilding it.
New routes: POST /events/bulk-action, POST /import/job/resume and POST /moderation/reports/resolve.
A deterministic manifest generator writes the countable inventory, and local CI now fails when the manifest, the version constants or the readme stable tag disagree with the plugin header.
The PHPUnit functional suite is now a gate rather than an opt-in, with a one-command test-library installer and a GitHub Actions job running both suites.
New evnm_attach_calendar_links() fills the add-to-calendar link set on every notification carrying an event, so an extension sending its own mail no longer has to build one.
New evnm_send_order_refund_email filter lets an extension replace the refund notice or stay quiet for a reversal the member has already seen.

Compat

Aligned with Eventonomy Pro 1.4.0. Install both updates together: Pro 1.4.0 requires this release, and older Pro builds keep working unchanged.

v1.3.0

July 1, 2026

New 12 Improve 10 Fix 26 Security 3 Dev 11

New

Event categories and tags can now be set when creating or editing an event, and a Categories & Tags admin screen lets the site owner manage both lists.
Each event chooses how people register: here, on another website, or not at all - so an announcement or a drop-in session no longer shows a registration form it does not need.
Mobile app backend: an app configuration endpoint, a member profile route, an in-app notifications feed, self-serve account deletion, event reporting, and a My Events data source.
Push device registration so a companion app can receive native notifications.
Mobile App settings tab lets the site owner configure and brand the app experience.
Single event responses return viewer-relative fields (the member's own RSVP status, whether they have checked in, and the remaining capacity), so an app can show the member's own state without extra requests.
Free RSVPs now mint a check-in token, so unpaid registrations can be checked in at the door.
Buyers have billing and invoice details on their account, stored on the same fields WooCommerce uses, so one saved address serves every purchase across your site.
A billing fieldset on the member profile lets a buyer save their invoice name, address, country and tax number.
Paid orders snapshot the buyer's billing details at purchase time and render them on the PDF invoice.
Complete ISO currency and country lists come from a single source, with the correct number of decimal places for every currency.
New wp eventonomy orphans command reports, and optionally deletes, rows left behind by events deleted before the cascade existed.

Improve

Paid checkout now creates an account for the buyer instead of taking the order as a guest, so every purchase has an owner, an order history and a retrievable invoice.
Admin tables collapse into labelled cards below 640px, so every column stays readable on a phone.
Admin forms stack label-above-control on small screens instead of squeezing inputs to a few pixels wide.
Event dates in the admin now honour the event's own time zone and the plugin's date format setting.
Large imports run entirely through the resumable background job, so a big migration no longer times out part-way and leaves the rest unimported.
Each batch of a migration now reads only the events it is about to import, instead of re-reading the whole source every batch. A 20,000 event migration read 4 million rows and needed 96 MB per batch; it now reads 20,000 and needs almost none, so large migrations finish on ordinary hosting.
Previewing a migration is bounded the same way, so scanning a large site no longer costs the memory the import itself was failing on.
Bulk attendee actions fetch their rows in one query instead of one query per attendee.
An author can list their own events through the API without site-manager permission.
The member dashboard navigation lays out cleanly on phones.

Fix

A recurring event showed "This event has ended" and refused registrations once any past occurrence existed, while listings correctly advertised the next date; search engines were told the same wrong date.
Members could not edit events they already own on sites that restrict who may create events; the Edit link silently returned them to the dashboard.
Money is now stored with enough precision for currencies that use three decimal places, such as Kuwaiti dinar, Bahraini dinar, Omani rial and Jordanian dinar. Amounts shown in CSV exports are still rounded to two decimals on those currencies; that is being finished in the next release.
"Feature this event" was shown to members who cannot set it; the flag was silently discarded on save.
The admin navigation kept showing PRO badges on Money and Reports after Pro was activated, next to a banner saying every capability was available.
The Command Center contradicted itself, showing the getting-started checklist as done while insisting first-run setup was unfinished.
Opening the manage-attendees screen without choosing an event reported a permission error instead of asking which event to manage.
A refunded order voided only the first 100 attendee tickets, so on a larger order every attendee past the hundredth kept a valid, scannable ticket after the money was returned.
A privacy data export reported that the site holds no name or email for a member, while the attendee list showed both.
Private events were readable by anyone who had the direct link, even though they were correctly hidden from lists, search and the API.
Events brought in by calendar import escaped the moderation queue when approval mode was on.
A registration or order naming an event that does not exist is now rejected instead of creating an orphaned row.
The Duplicate and Cancel buttons on the member dashboard stayed silent when the server refused the action, so a failure looked like a dead button.
Deleting an event now removes its occurrences, registrations, tickets, orders and metadata on every deletion path.
Guests can enter their name when they register.
Venue maps rendered blank for venues at extreme latitudes.
Frontend surfaces that fell back to unstyled browser defaults now pick up the shared design system.
Event dates in the admin could show the wrong calendar day when the event time zone differed from the site time zone.
Logged-in members appeared with no name or email on attendee lists, in confirmation and reminder emails, on check-in screens and in CSV exports.
The attendee count on the manage screen was capped at 100 and could not report the true total for larger events.
Attendee and RSVP counts disagreed across screens because each surface defined the count differently.
The Attendees and Orders tables showed a raw event ID instead of the event title.
The Event Tickets and Settings tabs on the event workspace rendered identical content.
Opening the manage screen for an event that no longer exists reported a permission error instead of saying the event was not found.
The attendee search and statistics area rendered misaligned because two unrelated components shared a CSS class.
Single event pages served through legacy URLs showed a generic browser tab title instead of the event name.

Security

Managing the attendees of an event you do not own now requires site-manager permission; previously any user who could edit others' posts could read every organizer's attendee list, cancel registrations, message attendees and check people in.
Restricting event creation to a specific role failed open for any role that is not one of WordPress's own, so a site restricting creation to a custom role was in fact letting every logged-in member create events.
Only users who can edit other people's events can set the site-wide Featured flag, so a member cannot promote their own event into the featured surface.

Dev

New shared helpers for recipient identity, batched member display names, relative time and currency symbols, plus an EventTitles helper for resolving event IDs to titles.
New RsvpRepository::count_by_event() and count_by_events() are the single source for attendee counts, with explicit status sets and a rows-versus-people switch.
New OccurrenceRepository::last_end_utc() removes the last direct database query from the provider layer.
New evnm_admin_rail_groups filter lets an extension register a page in the admin navigation rail.
New ImportRunnerInterface exposes import execution to extensions without reaching into internal classes.
New BulkNotificationChannelInterface and evnm_notify_bulk let a channel deliver one message to many recipients in a single operation; channels that do not opt in are unaffected.
New evnm_current_occurrence() resolves the occurrence a surface should show, and evnm_registration_modes() / evnm_event_accepts_registration() expose the per-event registration mode.
New EventService::apply_terms() is the one write path for event categories and tags, honoured by REST, WP-CLI and extensions.
New evnm_iterate_rows() walks a paginated repository query to completion, so a caller can no longer process one page and treat it as the whole set.
Cascade deletion and the orphan sweep run through repository methods; no SQL lives outside the repository layer.
Release builds strip development files at any directory depth.

v1.2.0

July 1, 2026

New 2 Improve 2 Fix 2 Dev 2

New

Events can be scoped to a space (community group) through the indexed space_id column, the foundation for group and community event listings.
GDPR personal-data exporter and eraser: a WordPress Export or Erase Personal Data request now covers Eventonomy's own tables, anonymizing RSVPs while orders keep their financial record under the tax-retention exemption.

Improve

Upcoming event lists sort on an index-friendly key, so large catalogs stay fast at any page depth.
New installs create a dedicated "Manage Events" dashboard page on the manage-events slug to avoid colliding with an existing /dashboard/ page; existing installs keep their mapped page.

Fix

The events-list Load more control preserves the block's space_id scope, so paginating a group list no longer pulls in events from other spaces.
Block registration is idempotent, so a second init pass no longer triggers a "block type already registered" notice.

Dev

The events-list and calendar blocks gain a spaceId attribute, GET /events accepts a space_id filter, and space_id is writable on POST /events and EventService::create.
Reminder jobs run under a dedicated eventonomy Action Scheduler group, cache-invalidation groups are constant-guarded, and the translation template (POT) was regenerated with the full string set.

v1.1.0

July 1, 2026

New 16 Improve 4 Fix 3 Security 1 Dev 1

New

One-click importers for The Events Calendar, EventON, Events Manager, WP Event Manager, and Sugar Calendar: scan preview, background processing for large sites, typed-confirmation undo, and 301 redirects from old event URLs.
Email blasts: message all registrants of an event from the manage-attendees panel.
Zero-config reminder emails (1 day and 1 hour before start), filterable via evnm_reminder_offsets.
Add to calendar everywhere: downloadable ICS with location and URL, plus Google and Outlook links on event pages, confirmations, and emails.
Live filtering on the events browse: results update as you type, with category quick-filter chips, a result count, and no page reload.
The Upcoming view is a date-bucketed agenda (Today, Tomorrow, This weekend, This week, Later this month) instead of a second card list.
Duplicate an existing event into a new draft from the dashboard, admin, or REST.
Who's-going avatar stack and attendance count on the event page (privacy-aware; can be turned off).
Celebratory RSVP confirmation card with the event date tile and an Add to Google Calendar action.
Member dashboard: a "Your next event" spotlight that also covers events you are attending, plus an "Events you're attending" cover-card panel.
Members without the upload capability can now upload a cover image through a capability-gated, rate-limited upload route; roles with the capability keep the media library picker.
Share menu on the event page (Copy link, Email, X, Facebook, WhatsApp) with a visible "Link copied" toast; the native share sheet is used where available.
Order tools in the admin: Mark as paid and Cancel actions, bulk attendee/order actions, and site-wide CSV exports.
Country selector and friendly timezone dropdown in the event editor; named per-field validation messages.
One-click unsubscribe for notification-class emails (stateless, legally safe), with resubscribe.
Online events get a hero badge and a registrant-only Join button that activates near start time.

Improve

Single events render without the auto-created "Event" page - no more near-blank page in the Pages list, and the browser tab shows the event title. The URL base remains translatable in Settings -> Permalinks.
Systematic theme CSS isolation: plugin surfaces keep their own look (including a consistent brand accent and dark mode) under any theme; native date pickers follow dark mode.
Maps read as maps: constrained embed with an Open in Maps link, dark tiles in dark mode, and nothing rendered when an event has no location.
RSVP capacity is claimed atomically so an event cannot oversell under concurrent sign-ups; attendee exports are batched for large events.

Fix

Interactivity blocks (RSVP, search, dashboard, editor) were dead under block themes such as Twenty Twenty-Four; all nine blocks now work on classic and block themes.
Editor validation messages never rendered (permanent red border with no text); event-date validation, the max-events limit for Editors, and the default event status now behave as configured.
Hardened orders-list authorization, RSVP gating, a trashed-page 404 guard, the settings-save notice, an N+1 query, uninstall cleanup, a Pro-feature gate, and a block render callback.

Security

Per-IP rate limiting now runs at the REST front door for RSVP and order creation, so malformed-request floods are throttled too; spam honeypot on public sign-ups.

Dev

New extension points: cover-upload route and filters, magic-link TTL, waitlist seam, invoice rows, per-page ceiling, overridable guest-receipt and unsubscribe templates, and an events-list router region for in-place filtering.

v1.0.0

July 1, 2026

New 12 Security 2 Dev 1

New

Events, RSVPs, tickets, orders, and recurring occurrences on custom tables with a 100% REST API (eventonomy/v1) and zero AJAX.
Interactivity-API blocks: events list, calendar, single event, RSVP, search and filter, event editor, my events, attendees.
Pretty URLs for single events (/event/{slug}/) and for every browse view (/events/grid/, /events/list/, /events/month/, /events/upcoming/); the bare /events/ honours the Default view setting.
Frontend member app: submit events, manage RSVPs, manage attendees, and a My Events console.
Custom admin console: settings, attendees and orders with search and pagination, setup and health, and a one-click demo-data seeder (WP-CLI and Tools page) with stock cover images.
Branded HTML email notifications behind a filterable shell, plus a subscribable ICS feed and per-event ICS.
Plug-and-play defaults on every option, RTL stylesheets, and a developer extension API (providers, hooks, container).
Automatic updates via the bundled licensing kit - no key entry needed for the free plugin.
Ticket checkout with an itemized order summary (subtotal, discount, service fee, tax, total) and a "Pay with" gateway selector when more than one payment gateway is configured.
Order confirmation card on the member dashboard (returning buyer): you're registered, your tickets, and where to go next - one landing surface for every gateway.
Order confirmation email, a downloadable PDF invoice, and account-less guest order retrieval by token.
Frontend organizer sales view - revenue, paid orders, attendees, and recent orders - so an author with no wp-admin can see who bought and how much.

Security

Public event lists and reads hide non-public events; guests are forced to the published status.
Order meta (access token, guest emails, refund ids) is never exposed in REST output; a refund or cancel releases the held ticket stock and voids the attendee ticket so it cannot check in.