CVE-2022-1194

The CVE-2022-1194 entry describes a CSV injection vulnerability in the Mobile Events Manager WordPress plugin prior to version 1.4.8. The issue arises because the plugin does not properly escape the Enquiry source field when exporting events or the Paid for field when exporting transactions to CS...

CVE-2021-25049

The CVE-2021-25049 entry concerns the WordPress Mobile Events Manager plugin prior to version 1.4.4, where lack of sanitisation/escaping of several settings allows high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks, even when unfiltered_html is disallowed. Affected componen...