MDJM Event Management vulnerabilities
We track 4 vulnerabilities in MDJM Event Management products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
Latest MDJM Event Management vulnerabilities
- 8.0 High severity
MDJM Event Management: Improper Neutralization of Input During Web Page Generation
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated
- 9.1 Critical severity
MDJM Event Management: Missing Authorization
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part
- 8.8 High severity
MDJM Event Management: Authorization Bypass Through User-Controlled Key
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password
- 7.5 High severity
MDJM Event Management: Missing Authorization
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist