GCVE - cpe:2.3:a:unknown:events_made_easy:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:events_made_easy:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Events Made Easy (`cd0ecba6-05a6-5275-adc4-6c5e66780c54`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-14842`	vulnerable	2026-09-16 04:33:12.090262	Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass MEDIUM (5.3) The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid. Published: 2026-08-06T17:00:54.129Z Updated: 2026-08-07T14:06:11.053Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/76856b3d-8f87-4d66-a22a-d65afa98c4ad/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-14843`	vulnerable	2026-09-16 04:33:11.553103	Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record. Published: 2026-07-31T06:00:07.231Z Updated: 2026-07-31T13:27:45.469Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/0b445129-19e2-4240-a79a-d3190161d369/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-1905`	vulnerable	2026-06-08 05:39:14.206549	Events Made Easy < 2.2.81 - Unauthenticated SQLi The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Published: 2022-06-20T10:26:17.000Z Updated: 2024-08-03T00:17:00.944Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/ff5fd894-aff3-400a-8eec-fad9d50f788e	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25030`	vulnerable	2026-06-08 05:30:39.830297	Events Made Easy < 2.2.36 - Subscriber+ SQL Injection The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks Published: 2022-01-03T12:49:17.000Z Updated: 2024-08-03T19:49:14.585Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/bc7058b1-ca93-4c45-9ced-7848c7ae4150	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24813`	vulnerable	2026-06-08 05:30:39.289016	Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Published: 2021-11-01T08:46:32.000Z Updated: 2024-08-03T19:42:17.348Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/a1fe0783-7a88-4d75-967f-cef970b73752 https://plugins.trac.wordpress.org/changeset/2607749/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.