WordPress Mobile Events Manager plugin <= 1.4.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile Events Manager versions = 1.4.8.3...

CVE-2026-88802

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-88802 MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-88802

CVE-2026-88802 affects two WordPress plugins: MDJM Event Management (before 1.7.8.5) and Mobile Events Manager (through 1.4.8.3). The root cause is the absence of a capability check, nonce validation, or record-type verification in the plugins' playlist entry removal endpoint. An unauthenticated ...

EUVD-2021-11961

Malware in sbrugna...

EUVD-2022-24534

Malicious code in bioql PyPI...

CVE-2022-1194

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...

CVE-2021-25049

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-1194

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...

CVE-2022-1194

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...

CVE-2022-1194

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...

Input validation

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...

CVE-2022-1194

The CVE-2022-1194 entry describes a CSV injection vulnerability in the Mobile Events Manager WordPress plugin prior to version 1.4.8. The issue arises because the plugin does not properly escape the Enquiry source field when exporting events or the Paid for field when exporting transactions to CS...

CVE-2022-1194 Mobile Events Manager < 1.4.8 - Admin+ CSV Injection

The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...

WordPress plugin Mobile Events Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in the WordPress...

Mobile Events Manager < 1.4.8 - Admin+ CSV Injection

The plugin does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability. Export events with malicious CSV: 1. Create and save a new Enquiry source and add the following in the name field...

WordPress Mobile Events Manager Plugin <= 1.4.7 - Authenticated CSV Injection vulnerability

Authenticated CSV Injection vulnerability discovered by Varun thorat in Mobile Events Manager versions = 1.4.7 Solution Update the WordPress Mobile Events Manager plugin to the latest available version at least 1.4.8...

WordPress Mobile Events Manager plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions prior to WordPress plugin Mobile Events Manager 1.4.4. The...

CVE-2021-25049

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25049

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...