Events Made Easy

Events Made Easy through 3.2.5 accepts unauthenticated attacker-controlled input that reaches browser output without adequate neutralization. A victim must visit or interact with the affected content for script to execute in the site's origin, allowing access to data and actions available to that browser session.

Events Made Easy through 3.2.5 lets a Contributor or higher store a traversal value that reaches the eme_single_event_page_template function. When any visitor opens the affected single-event page, the stored value can include and execute an arbitrary PHP file already present on the server. This can expose local data, bypass access controls or execute the PHP file's code; obtaining a suitable PHP file is an additional prerequisite where one is not already available.

Events Made Easy before 3.1.2 does not bind a payment authorization token to the payment record being charged. An unauthenticated attacker can pay a small amount for a low-cost booking, then apply that authorization to a separate higher-priced booking; the plugin accepts the mismatched token and marks the expensive booking fully paid. The payment endpoint, action, token and booking parameters, gateway and validation function are not disclosed. Version 3.1.2 adds price checks for charging and notifications.

Events Made Easy before 3.1.4 accepts an unauthenticated data-change request using a public nonce but does not require a per-record token or verify that the requester may modify the selected person record. A visitor can submit another person's record identifier with attacker-controlled personal data, overwriting that record. The published.

Events Made Easy through 3.1.3 permits an unauthenticated request to reach a plugin operation without the required access-control check.

Events Made Easy is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Events Made Easy is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Events Made Easy is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Events Made Easy is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Events Made Easy is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.