Quick Event Manager
Monthly
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.