Events Made Easy
Monthly
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenticated attackers to inject path-traversal payloads into the eme_single_event_page_template function, causing the server to include and execute arbitrary PHP files. The attack is persistent and passive: once a malicious event is saved, the payload fires automatically for any visitor who loads the affected single-event page, requiring no further attacker interaction post-submission. If the environment permits PHP file uploads, this escalates to full remote code execution; even without upload capability, existing PHP files can be included to bypass access controls or exfiltrate sensitive data. No public exploit identified at time of analysis.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenticated attackers to inject path-traversal payloads into the eme_single_event_page_template function, causing the server to include and execute arbitrary PHP files. The attack is persistent and passive: once a malicious event is saved, the payload fires automatically for any visitor who loads the affected single-event page, requiring no further attacker interaction post-submission. If the environment permits PHP file uploads, this escalates to full remote code execution; even without upload capability, existing PHP files can be included to bypass access controls or exfiltrate sensitive data. No public exploit identified at time of analysis.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.