Events Manager vulnerabilities
4 known vulnerabilities in Events Manager from Events Manager. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Events Manager: Improper Privilege Management
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, esca
- 8.1 High severity
Events Manager: Improper Neutralization of Special Elements used in an SQL Command
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent record
- 7.5 High severity
Events Manager: Exposure of Sensitive Information to an Unauthorized Actor
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is k
- 7.5 High severity
Events Manager: Improper Neutralization of Special Elements used in an SQL Command
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed cla