CVE-2025-1249

CVE-2025-1249 affects Pixelite Events Manager (WordPress plugin) up to version 6.6.4.1, describing a Missing Authorization vulnerability due to incorrectly configured access control. Impact and exploitation details are not provided beyond the general missing authorization vector. Public reference...

CVE-2025-1249 WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcus aka @msykes Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through = 6.6.4.1...

WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Revan Arifio Patchstack Alliance in WordPress Plugin Events Manager versions = 6.6.4.1...

PT-2025-8706 · Pixelite · Events Manager

Name of the Vulnerable Software and Affected Versions: Events Manager versions through 6.6.4.1 Description: The issue is related to a Missing Authorization vulnerability in Pixelite Events Manager, which allows exploitation due to incorrectly configured access control security levels...

WordPress plugin Events Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-11260

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the activestatus parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-11260

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the activestatus parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-11260

CVE-2024-11260 affects the WordPress plugin Events Manager – Calendar, Bookings, Tickets, and more! The Wordfence summary confirms a time-based SQL Injection via the active_status parameter in all versions up to 6.6.3, caused by insufficient escaping and incomplete query preparation, enabling una...

CVE-2024-11260 Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the activestatus parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter vulnerability

Unauthenticated SQL Injection via Event Status Parameter vulnerability discovered by mikemyers in WordPress Plugin Events Manager versions = 6.6.3...

CVE-2024-50532

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through = 0.1...

CVE-2024-50532 WordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through = 0.1...

CVE-2024-50532 WordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through = 0.1...

CVE-2024-50532

CVE-2024-50532 affecting WordPress plugin Events Manager Pro – extended (versions

WordPress plugin Events Manager Pro – extended 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

CSRF to Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Events Manager Pro – extended versions = 0.1...

WordPress Events Manager Pro – extended Plugin <= 0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Events Manager Pro – extended Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-50532 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 6e38b5b027b3 Credits SOPROBRO...

WordPress WP Events Manager plugin <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection vulnerability

Authenticated Subscriber+ Time-Based SQL Injection vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin WP Events Manager versions = 2.1.11...

WordPress WP Events Manager Plugin <= 2.1.11 is vulnerable to SQL Injection

Software WP Events Manager Type Plugin Vulnerable versions = 2.1.11 Fixed in 2.2.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7717 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 8f6af9be273e Credits Arkadiusz Hydzik Required privilege Subscribe...

CVE-2024-7717

The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...