Events Manager

Concurrent requests can exploit improper synchronization of a shared resource and leave an unauthorized integrity change. The CNA vector requires no authentication or victim interaction, but high attack complexity, consistent with a timing-dependent attack. The export does not identify the endpoint, shared resource, timing window or resulting change. It does not establish a booking, payment or privilege-escalation chain. Affected versions: <= 7.4.7.

An authenticated Subscriber can supply values that change database query semantics, enabling database information disclosure. The export does not identify the endpoint, SQL parameter, query function or extraction sequence. Arbitrary database writes and server-side code execution are not established. Affected versions: <= 7.4.6. The authoritative export identifies 7.4.7 as fixed for this CVE.

No attacker login is required by the supplied CVSS vector. Information intended to remain protected is exposed to an unauthorized caller. The vector reports limited confidentiality impact without victim interaction. The export does not identify the response, data fields or information contents, so credential or personal-data exposure cannot be assumed. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 7.4.5. The authoritative export identifies 7.4.6 as fixed for this CVE.

A logged-in low-privilege user can override the owner value in event or location search. The search does not enforce the caller scope and returns other accounts unpublished, pending or trashed events and venues, including full street addresses. The precise minimum WordPress role and endpoint are unspecified. Affected versions: 7.4.1 to < 7.4.5. Confirmed fixed release: 7.4.5.

A user authorized to manage one event tickets can replace ticket identifiers in an update request after authorization, overwriting another ticket and reassigning it to their event. Authorization to manage at least one event tickets is required; the precise WordPress role, endpoint and identifier fields are unspecified. Affected versions: < 7.4.5. Confirmed fixed release: 7.4.5.

Events Manager through 7.3.3 stores event attribute values using wp_unslash() without sanitization and renders the #_ATT{key} placeholder without output escaping. An Author or higher can store script in an event attribute; the same path is available without authentication when anonymous event submissions are enabled. The script executes when a visitor views the affected event page.

Events Manager through 7.4.0.1 lets an unauthenticated attacker supply a malicious header_format value to the search_events_grouped AJAX action. That path bypasses the shortcode's wp_kses() handling and output_grouped() echoes the value into the HTML body, causing script execution when a victim follows a crafted link.

Events Manager through 7.3.7.4 lets an Administrator store a malicious traversal key through em_options_save. The stored path later reaches include_once() on every admin_init invocation, including unauthenticated admin-ajax.php requests, and can execute arbitrary PHP when a suitable PHP file can be uploaded and included.

Events Manager through 7.4.0 does not properly verify authorization before returning event and location records. An unauthenticated attacker can view titles, dates, descriptions, and location details for records marked draft, pending, trashed, or private.

Events Manager through 7.4.0 lets a Contributor or higher store SQL metacharacters in a custom meta_key and then invoke event_duplicate or location_duplicate. Those actions read stored keys through get_post_meta() and concatenate them into an INSERT query, producing second-order SQL injection that can extract sensitive database information.

Events Manager from 7.1 before 7.4.1 resets WordPress's already-derived capability requirements inside EM_Archetypes::map_meta_cap() whenever an object ID resolves to an Events Manager post, even when the requested capability is unrelated. An empty required-capability list is treated as allowed. If a user ID collides with an Events Manager post ID, an unauthenticated attacker can change that user's password, promote the account to Administrator or delete it. The exact HTTP endpoint and request sequence are not disclosed; the affected operations are WordPress user edit, promotion and deletion capability checks.

Events Manager before 7.4.1 embeds an attacker-controlled EM_Person user_email directly into the EM_Comms_Consent query that finds guest booking IDs, and concatenates consent or revocation values into related DELETE and INSERT work. A Subscriber can inject SQL and tamper with other people's booking-consent records. Version 7.4.1 uses prepared queries and integer-casts booking IDs.

An unauthenticated attacker can supply input that Events Manager through 7.4.2 reflects into page output without adequate neutralization. Script executes in the site’s origin when a victim encounters the crafted response; the CNA vector explicitly requires user interaction. The endpoint, parameter, output context and victim role are unspecified. The revised authoritative version data identifies 7.4.3 as unaffected.

Events Manager before 7.4 exposes GET /wp-json/events-manager/v1/uploads without authorization. EM\Uploads\API::handle_load() accepts temp_id, constructs the corresponding file in the system temporary directory, reads it with file_get_contents() and returns the raw bytes. An unauthenticated caller who already knows another uploader's high-entropy temporary identifier can therefore retrieve the in-progress upload; guessing alone is infeasible, the identifier is normally disclosed only to the uploader, and the file is removed after submission or scheduled cleanup. The optional X-Filenames header can also carry identifier data.

Events Manager before 7.3.7 stores attacker-controlled registration data as booking metadata when No-User-Account Booking Mode is enabled, then deserializes it without restricting object classes. An unauthenticated booking can trigger a PHP object-injection gadget chain when later loaded, enabling database reads that may expose password hashes and secret keys.

Events Manager is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 7.3.6.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Events Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Events Manager is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager – Calendar, Bookings, Tickets, and more! is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Events Manager is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Events Manager is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.