Stored XSS in MDJM Event Management and Mobile Events Manager
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or nonce before creating a WordPress role from a name in the request, and they store that name without escaping it. Any authenticated user, such as a subscriber, can inject web scripts that run when an administrator opens a standard user management screen (CWE-79). The references include an exploit link.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | MDJM Event Management | up to 1.7.8.7 | — | No fix listed | CNA |
| Unknown | Mobile Events Manager | up to 1.7.8.7 | — | No fix listed | CNA |
- MDJM Event Management VendorUnknown Affected up to 1.7.8.7 Fixed in — No fix listed CNA
- Mobile Events Manager VendorUnknown Affected up to 1.7.8.7 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for MDJM Event Management or Mobile Events Manager.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-11-06 Threatist record created from CVE-2026-88801
- 2026-11-06 Alias added: GHSA-458f-8h9v-25hw
- 2026-11-06 Weakness changed · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
- 2026-11-06 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-88801 · CVE Program
- CVE-2026-88801 · NVD
- FIRST EPSS
- GHSA-458f-8h9v-25hw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences