Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: E-dynamics Clear all filters
TI-2023-13178 CVE-2023-28660 · GHSA-qg3q-cq5x-4g26

SQL injection in Events Made Easy WordPress Plugin

Priority HIGH 73

The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00872 Published 2023-03-22 No fix listed CWE-89
TI-2023-00385 CVE-2023-0404 · GHSA-c3wx-66v4-wf3g

Events Made Easy <= 2.3.16 - Missing Authorization

Priority LOW 25

The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00538 Published 2023-01-19 No fix listed CWE-862
TI-2022-01765 CVE-2022-1905 · GHSA-hp3q-wx9r-xwc6

Events Made Easy < 2.2.81 - Unauthenticated SQLi

Priority HIGH 68

The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.37105 Published 2022-06-20 Fixed in 2.2.81 CWE-89
TI-2021-07308 CVE-2021-25030 · GHSA-7542-2wqc-jc3v

Events Made Easy < 2.2.36 - Subscriber+ SQL Injection

Priority MEDIUM 41

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01401 Published 2022-01-03 Fixed in 2.2.36 CWE-89
TI-2021-07095 CVE-2021-24813 · GHSA-8jpj-47rv-xvr4

Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disal…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00704 Published 2021-11-01 Fixed in 2.2.24 CWE-79