Search
Find a vulnerability
Search criteria
6 vulnerabilities found for Events Made Easy by liedekef
CVE-2026-107649 (GCVE-0-2026-107649)
Vulnerability from nvd – Published: 2026-10-16 09:26 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
Summary
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| liedekef | Events Made Easy |
Affected:
0 , ≤ 3.2.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107649",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:33:27.374777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:01.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Events Made Easy",
"vendor": "liedekef",
"versions": [
{
"lessThanOrEqual": "3.2.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacek Sowi\u0144ski (dzaku)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027event[location_name]\u0027 parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T09:26:38.264Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f80a1fa2-d44b-4101-a891-fce21ee99427?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/includes/eme-locations.php#L3082"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/includes/eme-fs.php#L867"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/includes/eme-fs.php#L831"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/js/eme_show_maps.js#L208"
},
{
"url": "https://github.com/liedekef/events-made-easy/commit/3d9e92f98a9d9e443d65323ec8c86d598b3e34e0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3748824%40events-made-easy%2Ftags%2F3.2.23\u0026old=3723758%40events-made-easy%2Ftags%2F3.2.21"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T14:38:42.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T20:56:05.000Z",
"value": "Disclosed"
}
],
"title": "Events Made Easy \u003c= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via \u0027event[location_name]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-107649",
"datePublished": "2026-10-16T09:26:38.264Z",
"dateReserved": "2026-10-08T14:23:01.538Z",
"dateUpdated": "2026-10-16T14:39:01.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75963 (GCVE-0-2026-75963)
Vulnerability from nvd – Published: 2026-08-20 05:30 – Updated: 2026-08-20 15:26
VLAI
EPSS
VEX
Title
Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
Summary
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 15:05 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| liedekef | Events Made Easy |
Affected:
0 , ≤ 3.2.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75963",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T15:05:00.494443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:26:27.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Events Made Easy",
"vendor": "liedekef",
"versions": [
{
"lessThanOrEqual": "3.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T05:30:44.824Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24890c27-6db1-4ca9-8ebd-601fbce93d88?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.5/includes/eme-events.php#L1721"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.5/includes/eme-fs.php#L670"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.5/includes/eme-fs.php#L842"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3654766%40events-made-easy\u0026new=3654766%40events-made-easy"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-19T07:53:45.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-19T17:09:00.000Z",
"value": "Disclosed"
}
],
"title": "Events Made Easy \u003c= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via \u0027wp_page_template\u0027 Event Property"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-75963",
"datePublished": "2026-08-20T05:30:44.824Z",
"dateReserved": "2026-08-18T16:48:24.300Z",
"dateUpdated": "2026-08-20T15:26:27.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-0404 (GCVE-0-2023-0404)
Vulnerability from nvd – Published: 2023-01-19 14:25 – Updated: 2026-04-08 16:55
VLAI
EPSS
VEX
Title
Events Made Easy <= 2.3.16 - Missing Authorization
Summary
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-13 16:28 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| liedekef | Events Made Easy |
Affected:
0 , ≤ 2.3.16
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:10:55.787Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2836308%40events-made-easy\u0026new=2836308%40events-made-easy\u0026sfp_email=\u0026sfph_mail="
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-0404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-13T16:28:05.430669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-13T17:11:09.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Events Made Easy",
"vendor": "liedekef",
"versions": [
{
"lessThanOrEqual": "2.3.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Wotschka"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer\u0027s Github at https://github.com/liedekef/events-made-easy"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:55:11.395Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2836308%40events-made-easy\u0026new=2836308%40events-made-easy\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2022-12-23T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Events Made Easy \u003c= 2.3.16 - Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2023-0404",
"datePublished": "2023-01-19T14:25:17.678Z",
"dateReserved": "2023-01-19T14:25:11.815Z",
"dateUpdated": "2026-04-08T16:55:11.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107649 (GCVE-0-2026-107649)
Vulnerability from cvelistv5 – Published: 2026-10-16 09:26 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
Summary
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| liedekef | Events Made Easy |
Affected:
0 , ≤ 3.2.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107649",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:33:27.374777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:01.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Events Made Easy",
"vendor": "liedekef",
"versions": [
{
"lessThanOrEqual": "3.2.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jacek Sowi\u0144ski (dzaku)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027event[location_name]\u0027 parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T09:26:38.264Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f80a1fa2-d44b-4101-a891-fce21ee99427?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/includes/eme-locations.php#L3082"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/includes/eme-fs.php#L867"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/includes/eme-fs.php#L831"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.21/js/eme_show_maps.js#L208"
},
{
"url": "https://github.com/liedekef/events-made-easy/commit/3d9e92f98a9d9e443d65323ec8c86d598b3e34e0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3748824%40events-made-easy%2Ftags%2F3.2.23\u0026old=3723758%40events-made-easy%2Ftags%2F3.2.21"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T14:38:42.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T20:56:05.000Z",
"value": "Disclosed"
}
],
"title": "Events Made Easy \u003c= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via \u0027event[location_name]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-107649",
"datePublished": "2026-10-16T09:26:38.264Z",
"dateReserved": "2026-10-08T14:23:01.538Z",
"dateUpdated": "2026-10-16T14:39:01.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75963 (GCVE-0-2026-75963)
Vulnerability from cvelistv5 – Published: 2026-08-20 05:30 – Updated: 2026-08-20 15:26
VLAI
EPSS
VEX
Title
Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
Summary
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 15:05 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| liedekef | Events Made Easy |
Affected:
0 , ≤ 3.2.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75963",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T15:05:00.494443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:26:27.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Events Made Easy",
"vendor": "liedekef",
"versions": [
{
"lessThanOrEqual": "3.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T05:30:44.824Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24890c27-6db1-4ca9-8ebd-601fbce93d88?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.5/includes/eme-events.php#L1721"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.5/includes/eme-fs.php#L670"
},
{
"url": "https://plugins.trac.wordpress.org/browser/events-made-easy/tags/3.2.5/includes/eme-fs.php#L842"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3654766%40events-made-easy\u0026new=3654766%40events-made-easy"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-19T07:53:45.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-19T17:09:00.000Z",
"value": "Disclosed"
}
],
"title": "Events Made Easy \u003c= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via \u0027wp_page_template\u0027 Event Property"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-75963",
"datePublished": "2026-08-20T05:30:44.824Z",
"dateReserved": "2026-08-18T16:48:24.300Z",
"dateUpdated": "2026-08-20T15:26:27.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-0404 (GCVE-0-2023-0404)
Vulnerability from cvelistv5 – Published: 2023-01-19 14:25 – Updated: 2026-04-08 16:55
VLAI
EPSS
VEX
Title
Events Made Easy <= 2.3.16 - Missing Authorization
Summary
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-13 16:28 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| liedekef | Events Made Easy |
Affected:
0 , ≤ 2.3.16
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:10:55.787Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2836308%40events-made-easy\u0026new=2836308%40events-made-easy\u0026sfp_email=\u0026sfph_mail="
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-0404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-13T16:28:05.430669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-13T17:11:09.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Events Made Easy",
"vendor": "liedekef",
"versions": [
{
"lessThanOrEqual": "2.3.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Wotschka"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer\u0027s Github at https://github.com/liedekef/events-made-easy"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:55:11.395Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2836308%40events-made-easy\u0026new=2836308%40events-made-easy\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2022-12-23T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Events Made Easy \u003c= 2.3.16 - Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2023-0404",
"datePublished": "2023-01-19T14:25:17.678Z",
"dateReserved": "2023-01-19T14:25:11.815Z",
"dateUpdated": "2026-04-08T16:55:11.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}