Event Booking Manager For Woocommerce
Monthly
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.