Cross site scripting

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues...

Sql injection

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection...

CVE-2020-35037

Summary: CVE-2020-35037 affects the Events Manager WordPress plugin prior to 5.9.8. The vulnerability arises because certain search parameters are not sanitized/escaped before being output on pages, enabling cross-site scripting (XSS). Impact: potential client-side code execution via crafted sear...

CVE-2020-35012 Events Manager < 5.9.8 - Admin+ SQL Injection

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection...

CVE-2020-35012

The CVE concerns the Events Manager WordPress plugin (versions before 5.9.8). The root cause is failure to sanitise and escape a parameter before using it in an SQL statement, resulting in an SQL Injection. The vulnerability affects the plugin’s handling of input within SQL queries, with potentia...

PT-2021-11708 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: Events Manager WordPress plugin versions prior to 5.9.8 Description: The issue is related to an SQL Injection. The problem arises because a parameter is not properly sanitised and escaped before being used in a SQL statement. Recommendations:...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in Wordpress Plugin Events Manager that stems from the product...

PT-2021-11709 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: Events Manager WordPress plugin versions prior to 5.9.8 Description: The issue is related to the Events Manager WordPress plugin, where some search parameters are not properly sanitized and escaped before being output on pages. This could lea...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Wordpress Plugin Events Manager, which stems from the...

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

WordPress Events Manager plugin <= 5.9.7.3 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Antony Garand in WordPress Events Manager plugin versions = 5.9.7.3. Solution Update the WordPress Events Manager plugin to the latest available version at least 5.9.8...

WordPress Events Manager plugin <= 5.9.7.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Jakob Wierzba in WordPress Events Manager plugin versions = 5.9.7.3. Solution Update the WordPress Events Manager plugin to the latest available version at least 5.9.8...

WordPress Events Manager plugin <= 5.9.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Nguyen Van Khanh in WordPress Events Manager plugin versions = 5.9.8.1. Solution 2020-11-25 - we were unable to find a patched version of this plugin use at your own risk, we recommend to deactivate and delete the plugin until t...

Events Manager < 5.9.8 - SQL Injection

The Events Manager plugin was affected by an SQL Injection vulnerability...

Events Manager < 5.9.8 - Cross-Site Scripting (XSS)

The Events Manager WordPress plugin was affected by a Cross-Site Scripting XSS vulnerability...

Wordpress plugin events-manager local file disclosure vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. events-manager is an events management plugin used in it. A local file disclosure vulnerability exists in the wordpress plugin...

WordPress Events Manager plugin <= 5.9.7.1 - CSV Injection vulnerability

CSV Injection vulnerability found by Vishnupriya Ilango in WordPress Events Manager plugin versions = 5.9.7.1. Solution Update the WordPress Events Manager plugin to the latest available version at least 5.9.7.2...

WordPress Events Manager Pro plugin <= 2.6.7.1 - CSV Injection vulnerability

CSV Injection vulnerability found by Vishnupriya Ilango in WordPress Events Manager Pro plugin versions = 2.6.7.1. Solution Update the WordPress Events Manager Pro plugin to the latest available version at least 2.6.7.2...

Events Manager < 5.9.7.2 - CSV Injection

The Events Manager WordPress plugin was affected by a CSV Injection security vulnerability...

Events Manager Pro < 2.6.7.2 - CSV Injection

The events-manager-pro WordPress plugin was affected by a CSV Injection security vulnerability...