Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Events Manager 7.4.5 Clear all filters
TI-2026-63094 CVE-2026-93662 · GHSA-wvr6-m4wg-qf6q

Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter

Priority LOW 19

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpubl…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00196 Published 2026-09-24 Fixed in 7.4.5 CWE-200
TI-2026-63093 CVE-2026-93661 · GHSA-m227-gvmr-hx3v

Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

Priority LOW 13

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite a…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00187 Published 2026-09-24 Fixed in 7.4.5 CWE-639