CVE-2022-1194

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting XSS, as demonstrated by the /server/ajax/eventsmanager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the sit...

CVE-2021-25049

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2020-35012

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection...

CVE-2020-35037

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues...

CVE-2013-7477

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form...

CVE-2015-9298

The events-manager plugin before 5.6 for WordPress has code injection...

CVE-2013-7478

The events-manager plugin before 5.5 for WordPress has XSS via EMTicket::getpost...

CVE-2015-9300

The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues...

CVE-2012-6716

The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links...

CVE-2015-9299

The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS...

CVE-2025-1249

Missing Authorization vulnerability in Marcus aka @msykes Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through = 6.6.4.1...

CVE-2025-1249 WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcus aka @msykes Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through = 6.6.4.1...

CVE-2025-1249

CVE-2025-1249 affects Pixelite Events Manager (WordPress plugin) up to version 6.6.4.1, describing a Missing Authorization vulnerability due to incorrectly configured access control. Impact and exploitation details are not provided beyond the general missing authorization vector. Public reference...

CVE-2025-1249 WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pixelite Events Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through 6.6.4.1...

WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Revan Arifio Patchstack Alliance in WordPress Plugin Events Manager versions = 6.6.4.1...

PT-2025-8706 · Pixelite · Events Manager

Name of the Vulnerable Software and Affected Versions: Events Manager versions through 6.6.4.1 Description: The issue is related to a Missing Authorization vulnerability in Pixelite Events Manager, which allows exploitation due to incorrectly configured access control security levels...

WordPress plugin Events Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-1249: Missing Authorization

Missing Authorization vulnerability in Marcus aka @msykes Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through = 6.6.4.1...

CVE-2024-11260

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the activestatus parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...