Read the docs
TI-2017-14751 Aliases CVE-2017-1002026GHSA-rvvr-r24x-gg3r

SQL injection in Event Expresso Free

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.

Why it matters now

EPSS 0.01711 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Event Expresso Free (Event Espresso): 3.1.37.11.L

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Event EspressoEvent Expresso Freebefore 3.1.37.11.L3.1.37.11.LPatch availableCNA
  • Event Expresso Free VendorEvent Espresso Affected before 3.1.37.11.L Fixed in 3.1.37.11.L Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eventespresso:event_espresso:3.1.37.11.l:*:*:*:free:wordpress:*:*3.1.37.11.lVulnerableEvent Espresso
  • cpe:2.3:a:eventespresso:event_espresso:3.1.37.11.l:*:*:*:free:wordpress:*:* Versions 3.1.37.11.l Vulnerable ·Event Espresso

Remediation

  • Fix · CNA Event Expresso Free (Event Espresso) Fixed in 3.1.37.11.L

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1002026
  2. 2026-10-03 Alias added: GHSA-rvvr-r24x-gg3r

References

Exploit 1

Advisory 1

  • TI-2020-15988 A cross-site scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
  • TI-2024-06383 Missing authorization in Event Espresso – Event Registration & Ticketing Sales CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences