CVE-2023-28660

🗓️ 22 Mar 2023 00:00:00Reported by tenableType

cve🔗 web.nvd.nist.gov👁 72 Views🌐 WEB

The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerabilit

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2023-28660	22 Mar 202323:35	–	circl
CNNVD	WordPress Plugin Events Made Easy SQL注入漏洞	22 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-28660	22 Mar 202300:00	–	cvelist
EUVD	EUVD-2023-32321	3 Oct 202520:07	–	euvd
NVD	CVE-2023-28660	22 Mar 202321:15	–	nvd
OpenVAS	WordPress Events Made Easy Plugin <= 2.3.14 SQLi Vulnerability	9 Oct 202300:00	–	openvas
OSV	CVE-2023-28660	22 Mar 202321:15	–	osv
Patchstack	WordPress Events Made Easy Plugin <= 2.3.14 is vulnerable to SQL Injection	13 Apr 202300:00	–	patchstack
Prion	Sql injection	22 Mar 202321:15	–	prion
Positive Technologies	PT-2023-21882 · WordPress · Events Made Easy Wordpress Plugin	22 Mar 202300:00	–	ptsecurity

NVD

Node

e-dynamics events_made_easyRange≤2.3.14wordpress

[
  {
    "vendor": "n/a",
    "product": "Events Made Easy WordPress Plugin",
    "versions": [
      {
        "version": "<= 2.3.14",
        "status": "affected"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2023-2

Parameter	Position	Path	Description	CWE
search_name	query param	/wp-admin/admin-ajax.php?action=eme_recurrences_list&search_name=1'{+}AND{+}(SELECT+1+FROM+(SELECT(SLEEP(0.5)))a)-{-}+{-}	Authenticated SQL injection in eme_recurrences_list via the search_name parameter	CWE-89
action	query param	/wp-admin/admin-ajax.php?action=eme_recurrences_list&search_name=1'{+}AND{+}(SELECT+1+FROM+(SELECT(SLEEP(0.5)))a)-{-}+{-}	Authenticated SQL injection in eme_recurrences_list via the search_name parameter	CWE-89

17 Jun 2026 05:48Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

EPSS0.00872

SSVC

CWE-89