CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - Unauthenticated Privilege Escalation to Administrator 🔗 Stay Updated For the latest zero-days, exploits, and security research 📋 Vulnerability Overview Attribute| Details ---|--- CVE ID| CVE-2026-18366 Severity| 🔴 CRITICAL CVSS 9.8 Plugin| Events Manager for...

CVE-2026-18366

CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Privilege Escalation to Administrator | ---|--- Product| Events Manager WordPress plugin Affected versions| 7.1.0 – 7.4.0.x Fixed version| 7.4.1 Weakness| CWE-269: Improper Privilege Management Severity| CVSS 3.1: 9.8 Critical —...

CVE-2026-17089-PoC-pwnVader

CVE-2026-17089 — Events Manager = 7.4.0.1 — Unauthenticated reflected XSS headerformat Author: pwnVader · License: MIT repository root | ---|--- Component| Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin Type| CWE-79 — Reflected Cross-Site Scripting Affected| = 7.4.0.1...

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - Unauthenticated SQL Injection via orderby Parameter Description The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3...

CVE-2026-93661-idor-events-manager

CVE-2026-93661 — Events Manager Status: Published by WPScan · CVE assigned: CVE-2026-93661 · Verified · Fixed in 7.4.5 Private repository — for disclosure record-keeping and reproduction only. | ---|--- Repository| CVE-2026-93661-idor-events-manager Plugin| Events Manager events-manager Affected...

WordPress Mobile Events Manager plugin <= 1.7.8.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Ryan Fabella in WordPress Plugin Mobile Events Manager versions = 1.7.8.7...

WordPress Mobile Events Manager plugin <= 1.7.8.7 - Subscriber+ Account Takeover vulnerability

Subscriber+ Account Takeover vulnerability discovered by Morato Antoine in WordPress Plugin Mobile Events Manager versions = 1.7.8.7...

WordPress Mobile Events Manager plugin <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion vulnerability

Unauthenticated Arbitrary Role Deletion vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Mobile Events Manager versions = 1.7.8.7...

CVE-2026-88799

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other accoun...

CVE-2026-88801

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to injec...

CVE-2026-88800

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that...

CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that...

EUVD-2026-117969

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that...

CVE-2026-88801

The MDJM Event Management and Mobile Events Manager WordPress plugins (versions up to and including 1.7.8.7 ) are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to verify a capability or nonce before creating a WordPress role from a request-supplied name, combined...

EUVD-2026-117970

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to injec...

CVE-2026-88800

The MDJM Event Management and Mobile Events Manager WordPress plugins (versions up to and including 1.7.8.7 ) are vulnerable to unauthenticated arbitrary role deletion. The vulnerability exists because the plugin processes role deletion requests on every page load without performing capability ch...

CVE-2026-88801 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to injec...

CVE-2026-88799

The MDJM Event Management and Mobile Events Manager WordPress plugins (versions through 1.7.8.7 ) are vulnerable to an Insecure Direct Object Reference (IDOR) . The vulnerability exists because the plugins fail to verify ownership or authorization for identifiers provided during a client profile ...

EUVD-2026-117968

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other accoun...

CVE-2026-88799 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other accoun...