CVE-2022-1905

The CVE-2022-1905 entry documents an SQL injection in the WordPress plugin “Events Made Easy” before version 2.2.81. The vulnerability arises from improper sanitisation and escaping of a parameter used in a SQL statement via an unauthenticated AJAX action, allowing an attacker to inject SQL. The ...

CVE-2021-25030

CVE-2021-25030 : The WordPress plugin Events Made Easy (before 2.2.36) fails to sanitize and escape the search_text parameter used in the eme_searchmail AJAX action, enabling SQL injection when called by any authenticated user (e.g., roles as low as a subscriber). The vulnerability stems from imp...

CVE-2021-24813

CVE-2021-24813 affects the WordPress plugin Events Made Easy prior to version 2.2.24. The vulnerability arises from insufficient sanitisation/escaping of Custom Field Names in the form field handling, enabling an authenticated, high-privilege user to perform stored XSS even if unfiltered_html is ...