WordPress Events Made Easy plugin < 3.1.2 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Haitam Lazaar in WordPress Plugin Events Made Easy versions 3.1.2...

CVE-2026-28162

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

EUVD-2026-64793

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162

CVE-2026-28162 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Events Made Easy (versions ≤ 3.2.5 ). The vulnerability allows a remote unauthenticated attacker to inject and execute arbitrary script in another user's browser, with a CVSS 3.1 base score of 7....

PT-2026-80826

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

WordPress Events Made Easy plugin <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property vulnerability

Authenticated Contributor+ Local File Inclusion via 'wppagetemplate' Event Property vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Made Easy versions = 3.2.5...

WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Events Made Easy versions = 3.2.5...

CVE-2026-75963

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

EUVD-2026-63199

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

CVE-2026-75963: Improper Control of Filename for Include/Require Statement in PHP Program

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

PT-2026-78888

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme single event page template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrar...

EUVD-2026-54186

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

CVE-2026-14842

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

CVE-2026-14842

The CVE-2026-14842 entry concerns the Events Made Easy WordPress plugin prior to version 3.1.2. The root cause is that the payment authorization token is not bound to the specific payment record being charged, enabling an unauthenticated attacker to pay a lower amount for a cheap booking while a ...

CVE-2026-14842 Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

CVE-2026-14842 Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...