CVE-2026-107649

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventlocationname' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-102832

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventlocationname' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-107649 Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventlocationname' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-107649

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.2.22 . The root cause is insufficient input sanitization and output escaping of the 'event[location_name]' parameter. This allows unauthenticated attackers to inject ...

WordPress Events Made Easy plugin <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Jacek Sowiński dzaku in WordPress Plugin Events Made Easy versions = 3.2.22...

WordPress Events Made Easy plugin < 3.1.2 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Haitam Lazaar in WordPress Plugin Events Made Easy versions 3.1.2...

CVE-2026-28162

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

EUVD-2026-64793

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162

CVE-2026-28162 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Events Made Easy (versions ≤ 3.2.5 ). The vulnerability allows a remote unauthenticated attacker to inject and execute arbitrary script in another user's browser, with a CVSS 3.1 base score of 7....

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

PT-2026-80826

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

WordPress Events Made Easy plugin <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property vulnerability

Authenticated Contributor+ Local File Inclusion via 'wppagetemplate' Event Property vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Made Easy versions = 3.2.5...

WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Events Made Easy versions = 3.2.5...

CVE-2026-75963

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

EUVD-2026-63199

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

PT-2026-78888

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme single event page template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrar...