CVE-2026-18057

The CVE concerns the Events Manager WordPress plugin prior to version 7.4.1. It does not sanitize or escape a user-controlled value before use in a SQL statement, enabling users with a subscriber account and above to perform SQL injection and tamper with booking consent records belonging to other...