The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
Search vulnerabilities
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
The events-manager plugin before 5.6 for WordPress has code injection.
The events-manager plugin before 5.6 for WordPress has XSS.
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.