{"schema_version":"2","view":"grouped","data":[{"id":56332,"cve_ids":["CVE-2026-114694"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.","evidence":"cve:CVE-2026-114694","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114694","aliases":["CVE-2026-114694"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.9","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.4.8"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:46:56.850Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114694","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:37:55.542689Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:46:56.850Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-24T08:00:13.325Z"}}},"related_cves":[{"value":"CVE-2026-114694","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f708c95-e988-49f7-a187-0349c21c9d8c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114694","advisory_id":"1f708c95-e988-49f7-a187-0349c21c9d8c","event_types":["advisory"],"published_at":"2026-10-25T16:12:58.487667+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T08:00:13.325+00:00","detail_url":"/advisories/advisory%3A1f708c95-e988-49f7-a187-0349c21c9d8c","group":{"id":"advisory:1f708c95-e988-49f7-a187-0349c21c9d8c","revision":1,"primary_event_id":55855,"change":"published","superseded_by":[],"changed":{"id":55855,"cve_ids":["CVE-2026-114694"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.","evidence":"cve:CVE-2026-114694","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114694","aliases":["CVE-2026-114694"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.9","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.4.8"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:46:56.850Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114694","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:37:55.542689Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:46:56.850Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-24T08:00:13.325Z"}}},"related_cves":[{"value":"CVE-2026-114694","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f708c95-e988-49f7-a187-0349c21c9d8c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114694","advisory_id":"1f708c95-e988-49f7-a187-0349c21c9d8c","event_types":["advisory"],"published_at":"2026-10-25T16:12:58.487667+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T08:00:13.325+00:00","detail_url":"/events/55855"},"members":[{"id":55855,"cve_ids":["CVE-2026-114694"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.","evidence":"cve:CVE-2026-114694","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-114694","aliases":["CVE-2026-114694"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.9","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.4.8"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-24T14:46:56.850Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114694","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-24T14:37:55.542689Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T14:46:56.850Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-24T08:00:13.325Z"}}},"related_cves":[{"value":"CVE-2026-114694","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f708c95-e988-49f7-a187-0349c21c9d8c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114694","advisory_id":"1f708c95-e988-49f7-a187-0349c21c9d8c","event_types":["advisory"],"published_at":"2026-10-25T16:12:58.487667+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T08:00:13.325+00:00","detail_url":"/events/55855"}]}},{"id":17263,"cve_ids":["CVE-2026-42689"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.","evidence":"cve:CVE-2026-42689","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-42689","aliases":["CVE-2026-42689"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"7.4.7"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-12T22:53:59.670Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-7-race-condition-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42689","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-12T22:45:14.267112Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-12T22:53:59.670Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-12T17:48:52.025Z"}}},"related_cves":[{"value":"CVE-2026-42689","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f2a9dab-c265-4e94-9421-0f3080a2578c","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42689","advisory_id":"1f2a9dab-c265-4e94-9421-0f3080a2578c","event_types":["advisory"],"published_at":"2026-10-25T01:28:40.404703+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T17:47:51.774+00:00","detail_url":"/advisories/advisory%3A1f2a9dab-c265-4e94-9421-0f3080a2578c","group":{"id":"advisory:1f2a9dab-c265-4e94-9421-0f3080a2578c","revision":1,"primary_event_id":17152,"change":"published","superseded_by":[],"changed":{"id":17152,"cve_ids":["CVE-2026-42689"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.","evidence":"cve:CVE-2026-42689","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-42689","aliases":["CVE-2026-42689"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"7.4.7"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-12T22:53:59.670Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-7-race-condition-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42689","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-12T22:45:14.267112Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-12T22:53:59.670Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-12T17:48:52.025Z"}}},"related_cves":[{"value":"CVE-2026-42689","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f2a9dab-c265-4e94-9421-0f3080a2578c","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42689","advisory_id":"1f2a9dab-c265-4e94-9421-0f3080a2578c","event_types":["advisory"],"published_at":"2026-10-25T01:28:40.404703+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T17:47:51.774+00:00","detail_url":"/events/17152"},"members":[{"id":17152,"cve_ids":["CVE-2026-42689"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.","evidence":"cve:CVE-2026-42689","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-42689","aliases":["CVE-2026-42689"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"7.4.7"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-12T22:53:59.670Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-7-race-condition-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42689","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-12T22:45:14.267112Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-12T22:53:59.670Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-12T17:48:52.025Z"}}},"related_cves":[{"value":"CVE-2026-42689","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f2a9dab-c265-4e94-9421-0f3080a2578c","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42689","advisory_id":"1f2a9dab-c265-4e94-9421-0f3080a2578c","event_types":["advisory"],"published_at":"2026-10-25T01:28:40.404703+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T17:47:51.774+00:00","detail_url":"/events/17152"}]}},{"id":16914,"cve_ids":["CVE-2026-42633"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability","summary":"Subscriber SQL Injection in Events Manager <= 7.4.6 versions.","evidence":"cve:CVE-2026-42633","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-42633","aliases":["CVE-2026-42633"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Marcus","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.7","status":"unaffected"}],"version":"n/a","versionType":"custom","lessThanOrEqual":"7.4.6"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-11T12:03:20.589Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-6-sql-injection-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42633","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-11T11:52:26.396870Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-11T12:03:20.589Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-10T19:35:07.003Z"}}},"related_cves":[{"value":"CVE-2026-42633","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18c4ed07-bc15-4d1b-9789-de9dd056c68f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42633","advisory_id":"18c4ed07-bc15-4d1b-9789-de9dd056c68f","event_types":["advisory"],"published_at":"2026-10-25T01:22:32.564603+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-10T19:35:07.003+00:00","detail_url":"/advisories/advisory%3A18c4ed07-bc15-4d1b-9789-de9dd056c68f","group":{"id":"advisory:18c4ed07-bc15-4d1b-9789-de9dd056c68f","revision":1,"primary_event_id":16807,"change":"published","superseded_by":[],"changed":{"id":16807,"cve_ids":["CVE-2026-42633"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability","summary":"Subscriber SQL Injection in Events Manager <= 7.4.6 versions.","evidence":"cve:CVE-2026-42633","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-42633","aliases":["CVE-2026-42633"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Marcus","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.7","status":"unaffected"}],"version":"n/a","versionType":"custom","lessThanOrEqual":"7.4.6"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-11T12:03:20.589Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-6-sql-injection-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42633","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-11T11:52:26.396870Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-11T12:03:20.589Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-10T19:35:07.003Z"}}},"related_cves":[{"value":"CVE-2026-42633","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18c4ed07-bc15-4d1b-9789-de9dd056c68f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42633","advisory_id":"18c4ed07-bc15-4d1b-9789-de9dd056c68f","event_types":["advisory"],"published_at":"2026-10-25T01:22:32.564603+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-10T19:35:07.003+00:00","detail_url":"/events/16807"},"members":[{"id":16807,"cve_ids":["CVE-2026-42633"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability","summary":"Subscriber SQL Injection in Events Manager <= 7.4.6 versions.","evidence":"cve:CVE-2026-42633","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-42633","aliases":["CVE-2026-42633"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Marcus","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.7","status":"unaffected"}],"version":"n/a","versionType":"custom","lessThanOrEqual":"7.4.6"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-11T12:03:20.589Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-6-sql-injection-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42633","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-11T11:52:26.396870Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-11T12:03:20.589Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-10T19:35:07.003Z"}}},"related_cves":[{"value":"CVE-2026-42633","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18c4ed07-bc15-4d1b-9789-de9dd056c68f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42633","advisory_id":"18c4ed07-bc15-4d1b-9789-de9dd056c68f","event_types":["advisory"],"published_at":"2026-10-25T01:22:32.564603+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-10T19:35:07.003+00:00","detail_url":"/events/16807"}]}},{"id":8591,"cve_ids":["CVE-2026-105068"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.","evidence":"cve:CVE-2026-105068","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105068","aliases":["CVE-2026-105068"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.6","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.4.5"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-05T12:56:44.259Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-5-sensitive-data-exposure-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105068","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T12:56:34.956630Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T12:56:44.259Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-05T08:26:46.416Z"}}},"related_cves":[{"value":"CVE-2026-105068","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e4a3d0ec-d935-4355-bb40-a02bc7c1070d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105068","advisory_id":"e4a3d0ec-d935-4355-bb40-a02bc7c1070d","event_types":["advisory"],"published_at":"2026-10-24T23:03:12.918707+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T08:26:46.416+00:00","detail_url":"/advisories/advisory%3Ae4a3d0ec-d935-4355-bb40-a02bc7c1070d","group":{"id":"advisory:e4a3d0ec-d935-4355-bb40-a02bc7c1070d","revision":1,"primary_event_id":8581,"change":"published","superseded_by":[],"changed":{"id":8581,"cve_ids":["CVE-2026-105068"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.","evidence":"cve:CVE-2026-105068","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105068","aliases":["CVE-2026-105068"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.6","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.4.5"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-05T12:56:44.259Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-5-sensitive-data-exposure-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105068","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T12:56:34.956630Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T12:56:44.259Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-05T08:26:46.416Z"}}},"related_cves":[{"value":"CVE-2026-105068","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e4a3d0ec-d935-4355-bb40-a02bc7c1070d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105068","advisory_id":"e4a3d0ec-d935-4355-bb40-a02bc7c1070d","event_types":["advisory"],"published_at":"2026-10-24T23:03:12.918707+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T08:26:46.416+00:00","detail_url":"/events/8581"},"members":[{"id":8581,"cve_ids":["CVE-2026-105068"],"payload":{"kind":"advisory","title":"WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.","evidence":"cve:CVE-2026-105068","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-105068","aliases":["CVE-2026-105068"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Pixelite","product":"Events Manager","versions":[{"status":"affected","changes":[{"at":"7.4.6","status":"unaffected"}],"version":"0","versionType":"custom","lessThanOrEqual":"7.4.5"}],"packageName":"events-manager","collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected"}],"modified":"2026-10-05T12:56:44.259Z","provider":"cve","references":["https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-5-sensitive-data-exposure-vulnerability?_s_id=cve"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-105068","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-05T12:56:34.956630Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T12:56:44.259Z"}}],"cna":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-10-05T08:26:46.416Z"}}},"related_cves":[{"value":"CVE-2026-105068","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e4a3d0ec-d935-4355-bb40-a02bc7c1070d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105068","advisory_id":"e4a3d0ec-d935-4355-bb40-a02bc7c1070d","event_types":["advisory"],"published_at":"2026-10-24T23:03:12.918707+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T08:26:46.416+00:00","detail_url":"/events/8581"}]}},{"id":550,"cve_ids":["CVE-2026-93662"],"payload":{"kind":"advisory","title":"Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter","summary":"The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","evidence":"cve:CVE-2026-93662","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93662","aliases":["CVE-2026-93662"],"metrics":[],"affected":[{"vendor":"Unknown","product":"Events Manager","versions":[{"status":"affected","version":"7.4.1","lessThan":"7.4.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T10:41:54.239Z","provider":"cve","references":["https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-93662","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T10:33:25.889458Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T10:41:54.239Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-09-24T06:00:20.691Z"}}},"related_cves":[{"value":"CVE-2026-93662","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e935a9fd-c64f-4e5a-80e5-cfe6b8f67258","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93662","advisory_id":"e935a9fd-c64f-4e5a-80e5-cfe6b8f67258","event_types":["advisory"],"published_at":"2026-10-24T20:47:20.362013+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T06:00:20.691+00:00","detail_url":"/advisories/advisory%3Ae935a9fd-c64f-4e5a-80e5-cfe6b8f67258","group":{"id":"advisory:e935a9fd-c64f-4e5a-80e5-cfe6b8f67258","revision":1,"primary_event_id":542,"change":"published","superseded_by":[],"changed":{"id":542,"cve_ids":["CVE-2026-93662"],"payload":{"kind":"advisory","title":"Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter","summary":"The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","evidence":"cve:CVE-2026-93662","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93662","aliases":["CVE-2026-93662"],"metrics":[],"affected":[{"vendor":"Unknown","product":"Events Manager","versions":[{"status":"affected","version":"7.4.1","lessThan":"7.4.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T10:41:54.239Z","provider":"cve","references":["https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-93662","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T10:33:25.889458Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T10:41:54.239Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-09-24T06:00:20.691Z"}}},"related_cves":[{"value":"CVE-2026-93662","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e935a9fd-c64f-4e5a-80e5-cfe6b8f67258","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93662","advisory_id":"e935a9fd-c64f-4e5a-80e5-cfe6b8f67258","event_types":["advisory"],"published_at":"2026-10-24T20:47:20.362013+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T06:00:20.691+00:00","detail_url":"/events/542"},"members":[{"id":542,"cve_ids":["CVE-2026-93662"],"payload":{"kind":"advisory","title":"Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter","summary":"The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","evidence":"cve:CVE-2026-93662","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93662","aliases":["CVE-2026-93662"],"metrics":[],"affected":[{"vendor":"Unknown","product":"Events Manager","versions":[{"status":"affected","version":"7.4.1","lessThan":"7.4.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T10:41:54.239Z","provider":"cve","references":["https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-93662","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T10:33:25.889458Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T10:41:54.239Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-09-24T06:00:20.691Z"}}},"related_cves":[{"value":"CVE-2026-93662","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e935a9fd-c64f-4e5a-80e5-cfe6b8f67258","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93662","advisory_id":"e935a9fd-c64f-4e5a-80e5-cfe6b8f67258","event_types":["advisory"],"published_at":"2026-10-24T20:47:20.362013+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T06:00:20.691+00:00","detail_url":"/events/542"}]}},{"id":548,"cve_ids":["CVE-2026-93661"],"payload":{"kind":"advisory","title":"Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR","summary":"The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","evidence":"cve:CVE-2026-93661","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93661","aliases":["CVE-2026-93661"],"metrics":[],"affected":[{"vendor":"Unknown","product":"Events Manager","versions":[{"status":"affected","version":"0","lessThan":"7.4.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T10:41:54.370Z","provider":"cve","references":["https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-93661","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T10:33:34.908014Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T10:41:54.370Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-09-24T06:00:20.439Z"}}},"related_cves":[{"value":"CVE-2026-93661","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:27bd1efe-c680-4f7c-8ac5-013d84e25e32","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93661","advisory_id":"27bd1efe-c680-4f7c-8ac5-013d84e25e32","event_types":["advisory"],"published_at":"2026-10-24T20:47:19.111256+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T06:00:20.439+00:00","detail_url":"/advisories/advisory%3A27bd1efe-c680-4f7c-8ac5-013d84e25e32","group":{"id":"advisory:27bd1efe-c680-4f7c-8ac5-013d84e25e32","revision":1,"primary_event_id":540,"change":"published","superseded_by":[],"changed":{"id":540,"cve_ids":["CVE-2026-93661"],"payload":{"kind":"advisory","title":"Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR","summary":"The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","evidence":"cve:CVE-2026-93661","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93661","aliases":["CVE-2026-93661"],"metrics":[],"affected":[{"vendor":"Unknown","product":"Events Manager","versions":[{"status":"affected","version":"0","lessThan":"7.4.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T10:41:54.370Z","provider":"cve","references":["https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-93661","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T10:33:34.908014Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T10:41:54.370Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-09-24T06:00:20.439Z"}}},"related_cves":[{"value":"CVE-2026-93661","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:27bd1efe-c680-4f7c-8ac5-013d84e25e32","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93661","advisory_id":"27bd1efe-c680-4f7c-8ac5-013d84e25e32","event_types":["advisory"],"published_at":"2026-10-24T20:47:19.111256+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T06:00:20.439+00:00","detail_url":"/events/540"},"members":[{"id":540,"cve_ids":["CVE-2026-93661"],"payload":{"kind":"advisory","title":"Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR","summary":"The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","evidence":"cve:CVE-2026-93661","products":[{"name":{"value":"Events Manager","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93661","aliases":["CVE-2026-93661"],"metrics":[],"affected":[{"vendor":"Unknown","product":"Events Manager","versions":[{"status":"affected","version":"0","lessThan":"7.4.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T10:41:54.370Z","provider":"cve","references":["https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-93661","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T10:33:34.908014Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T10:41:54.370Z"}}],"cna":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-09-24T06:00:20.439Z"}}},"related_cves":[{"value":"CVE-2026-93661","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:27bd1efe-c680-4f7c-8ac5-013d84e25e32","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93661","advisory_id":"27bd1efe-c680-4f7c-8ac5-013d84e25e32","event_types":["advisory"],"published_at":"2026-10-24T20:47:19.111256+00:00","technologies":["core-cve","events-manager"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T06:00:20.439+00:00","detail_url":"/events/540"}]}}],"next_after":56332,"next_before":548}