Mobile Events Manager vulnerabilities
We track 5 vulnerabilities in Mobile Events Manager products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
Latest Mobile Events Manager vulnerabilities
- 8.0 High severity
MDJM Event Management: Improper Neutralization of Input During Web Page Generation
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated
- 9.1 Critical severity
MDJM Event Management: Missing Authorization
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part
- 8.8 High severity
MDJM Event Management: Authorization Bypass Through User-Controlled Key
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password
- 7.5 High severity
MDJM Event Management: Missing Authorization
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist
- 8.8 High severity
Mobile Events Manager: Improper Neutralization of Formula Elements in a CSV File
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.