Events Manager Plugin SQL Injection and Auth Bypass

Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Second-order SQL injection in the Events Manager WordPress plugin (all versions through 7.4.0) allows authenticated contributors to extract sensitive data from the WordPress database by exploiting unsafe meta key concatenation in the event and location duplication flow. An attacker with contributor-level access plants SQL metacharacters in a custom event or location meta key via the standard WordPress add-meta interface; WordPress stores these verbatim in wp_postmeta, and when the duplicate action is subsequently invoked, the plugin reads the stored key via get_post_meta() and concatenates it unsafely into an INSERT SQL query. No public exploit has been identified at time of analysis, but Wordfence has published the advisory and the vulnerable code paths in em-event.php and em-location.php are exposed via Trac source references, significantly lowering the barrier to exploit construction.

Reflected Cross-Site Scripting in the Events Manager WordPress plugin (all versions up to and including 7.4.0.1) allows unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The attack surface is the plugin's unauthenticated 'search_events_grouped' AJAX action, which accepts the 'header_format' parameter and passes it to output_grouped() without sanitization - bypassing the wp_kses() protection applied only at the shortcode entry point. No public exploit code or CISA KEV listing was identified at time of analysis; exploitation requires tricking a victim into clicking a crafted link.

Authorization bypass in the Events Manager WordPress plugin (versions up to and including 7.4.0) exposes restricted event metadata to unauthenticated remote attackers. The plugin fails to verify user authorization before returning event and location data, allowing any internet user to retrieve titles, dates, descriptions, and location details that administrators have explicitly restricted as draft, pending, trashed, or private. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a patched version (7.4.1) is confirmed available via the WordPress plugin repository changeset.