Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Events Manager 7.4.1 Clear all filters
TI-2026-15101 CVE-2026-18366 · GHSA-gpp5-qcrv-vm9j

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

Priority HIGH 82

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticat…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00498 Published 2026-08-12 Fixed in 7.4.1 CWE-269
TI-2026-14867 CVE-2026-18057 · GHSA-xxj4-g6jj-4r95

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

Priority HIGH 70

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attack…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00386 Published 2026-08-12 Fixed in 7.4.1 CWE-89