Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-18050

Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Events Manager
CVE-2026-66457

WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pixelite Wordpress-extensions
Products
Events Manager Events Manager
CVE-2026-105068

WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pixelite Wordpress-extensions
Products
Events Manager Events Manager
CVE-2026-114694

WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pixelite Wordpress-extensions
Products
Events Manager Events Manager
CVE-2026-42689

WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Pixelite Wordpress-extensions
Products
Events Manager Events Manager
CVE-2026-93661

Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Events Manager