GCVE - cpe:2.3:a:unknown:events_manager:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:events_manager:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Events Manager (`42715c4c-2139-5d6d-8aa9-90fa277d1bd6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-18050`	vulnerable	2026-09-16 04:34:02.233752	Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone. Published: 2026-08-06T06:00:10.996Z Updated: 2026-08-06T14:24:54.685Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/84964951-d25a-4753-bf71-fe00e2492a89/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-18366`	vulnerable	2026-09-16 04:34:02.096857	Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts. Published: 2026-08-12T06:00:17.317Z Updated: 2026-08-12T19:40:55.219Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/82767ce2-01e4-46ad-a52b-72d3ab2049bd/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-18057`	vulnerable	2026-09-16 04:34:01.777611	Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people. Published: 2026-08-12T06:00:16.972Z Updated: 2026-08-12T16:05:51.018Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/e2685778-936f-4920-9b5c-0fcbb9da6d26/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-12987`	vulnerable	2026-07-29 00:23:32.733760	Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded. Published: 2026-07-22T06:00:02.698Z Updated: 2026-07-22T12:59:16.253Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/dac83702-298d-4422-b795-b7684cc3fb2b/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-35037`	vulnerable	2026-06-08 05:25:00.802407	Events Manager < 5.9.8 - Cross-Site Scripting (XSS) The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues Published: 2021-12-01T22:50:11.000Z Updated: 2024-08-04T16:55:10.598Z Open on db.gcve.eu Reference links https://plugins.trac.wordpress.org/changeset/2336019/events-manager https://wpscan.com/vulnerability/937b9bdb-7e8e-4ea8-82ec-aa5f6bd70619	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-35012`	vulnerable	2026-06-08 05:25:00.801067	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.