WordPress Events Made Easy plugin <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Made Easy versions = 3.3.1...

WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Events Manager versions = 7.4.8...

WordPress Events Manager SQL Injection Vulnerability

WordPress Events Manager versions 7.4.6 and earlier have a SQL injection vulnerability. This vulnerability stems from SQL injections by subscribers and can lead to SQL injection attacks...

CVE-2026-105068 WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5...

WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Events Manager versions = 7.4.5...

WordPress Events Manager plugin 7.4.1-7.4.4 - Subscriber+ Unpublished Event and Location Disclosure vulnerability

Subscriber+ Unpublished Event and Location Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Events Manager versions 7.4.1-7.4.4...

WordPress Events Manager 7.4 Unauthenticated Administrator Privilege Escalation

WordPress Events Manager versions 7.4 and below contain an unauthenticated privilege escalation vulnerability caused by improper capability mapping for event and location post identifiers. An unauthenticated attacker can exploit a collision between a WordPress user ID and an Events Manager post I...

CVE-2026-66457 WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2...

CVE-2026-66457

The Pixelite Events Manager plugin for WordPress (versions n/a through 7.4.2 ) is vulnerable to Reflected Cross-site Scripting (XSS) due to the improper neutralization of input during web page generation. This vulnerability allows an unauthenticated attacker to inject malicious scripts into web p...

WordPress Events Calendar <1.4.5 - Cross-Site Scripting Detection

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Events Made Easy versions = 3.1.3...

CVE-2025-69135

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...

CVE-2025-69135 WordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerability

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...

WordPress Events <= 2.3.4 Authenticated Hash Dump

The WordPress Events plugin = 2.3.4 contains an authenticated SQL injection in the event editing workflow. Any user able to manage events can abuse it to extract WordPress password hashes from the database. from urllib.parse import urlencode import re from kittysploit import from...

PT-2026-20364

The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp events' shortcode in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Events Manager plugin <= 7.2.2.2 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by thinnawarth mathuros in WordPress Plugin Events Manager versions = 7.2.2.2...

CVE-2025-58265 WordPress Events Manager – OpenStreetMaps Plugin <= 4.2.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stonehenge Creations Events Manager – OpenStreetMaps stonehenge-em-osm allows Stored XSS.This issue affects Events Manager – OpenStreetMaps: from n/a through = 4.2.1...

CVE-2025-58265

CVE-2025-58265 : Stored XSS in WordPress plugin “Events Manager – OpenStreetMaps” (Stonehenge Creations). Affected: Events Manager – OpenStreetMaps, version range up to 4.2.1. Root cause: improper input neutralization during web page generation, enabling authenticated users to inject scripts that...

WordPress The Events Calendar plugin <= 6.15.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by mikemyers in WordPress Plugin The Events Calendar versions = 6.15.1...

CVE-2025-58862 WordPress WordPress Events Calendar Plugin – connectDaily Plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Stored XSS.This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through = 1.5...