WordPress Mobile Events Manager plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions prior to WordPress plugin Mobile Events Manager 1.4.4. The...

CVE-2021-25049

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25049

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25049

The CVE-2021-25049 entry concerns the WordPress Mobile Events Manager plugin prior to version 1.4.4, where lack of sanitisation/escaping of several settings allows high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks, even when unfiltered_html is disallowed. Affected componen...

WordPress plugin 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions prior to WordPress plugin Mobile Events Manager 1.4.4. The...

PT-2022-9605 · WordPress · Mobile Events Manager

Name of the Vulnerable Software and Affected Versions: Mobile Events Manager WordPress plugin versions prior to 1.4.4 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of various settings, even when the unfilter...

Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Payload used: - Put the payload in the TMEM Events Settings Events Event prefix field, then Create an...

WordPress Mobile Events Manager plugin <= 1.4.3.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Varun thorat in WordPress Mobile Events Manager plugin versions = 1.4.3.1. Solution Update the WordPress Mobile Events Manager plugin to the latest available version at least 1.4.4...

Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Payload used: alert/XSS/ - Put the payload in the TMEM Events Settings Events Event prefix field, then Creat...

WordPress Events Manager Plugin < 5.9.8 Multiple Vulnerabilities

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-100246)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Wordpress Plugin Events Manager, which stems from the...

WordPress SQL Injection Vulnerability (CNVD-2021-100245)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in Wordpress Plugin Events Manager that stems from the product...

CVE-2020-35012

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection...

CVE-2020-35012

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection...

CVE-2020-35037

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues...

Cross site scripting

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues...

Sql injection

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection...

CVE-2020-35037

Summary: CVE-2020-35037 affects the Events Manager WordPress plugin prior to 5.9.8. The vulnerability arises because certain search parameters are not sanitized/escaped before being output on pages, enabling cross-site scripting (XSS). Impact: potential client-side code execution via crafted sear...

CVE-2020-35012 Events Manager < 5.9.8 - Admin+ SQL Injection

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection...

CVE-2020-35012

The CVE concerns the Events Manager WordPress plugin (versions before 5.9.8). The root cause is failure to sanitise and escape a parameter before using it in an SQL statement, resulting in an SQL Injection. The vulnerability affects the plugin’s handling of input within SQL queries, with potentia...