Unknown Events Manager vulnerabilities

• mdjm event management, unknown mdjm event management, mobile events manager +2 more MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation CVE-2026-88801 8.0 HighNovember 6, 2026
• mdjm event management, unknown mdjm event management, mobile events manager +2 more MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion CVE-2026-88800 9.1 CriticalNovember 6, 2026
• mdjm event management, unknown mdjm event management, mobile events manager +2 more MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR CVE-2026-88799 8.8 HighNovember 6, 2026
• pixelite events manager Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter CVE-2026-93662 4.3 MediumSeptember 24, 2026
• pixelite events manager Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR CVE-2026-93661 Public exploit 2.7 LowSeptember 24, 2026
• mdjm event management, unknown mdjm event management, mobile events manager +2 more MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion CVE-2026-88802 7.5 HighSeptember 13, 2026
• pixelite events manager Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator CVE-2026-18366 Public exploit 9.8 CriticalAugust 12, 2026
• pixelite events manager Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection CVE-2026-18057 8.1 HighAugust 12, 2026
• thimpress wp events manager WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR CVE-2026-15148 5.3 MediumAugust 7, 2026
• thimpress wp events manager WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter CVE-2026-14205 9.8 CriticalAugust 7, 2026
• pixelite events manager Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads CVE-2026-18050 7.5 HighAugust 6, 2026
• pixelite events manager Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration CVE-2026-12987 7.5 HighJuly 22, 2026
• mobileeventsmanager mobile events manager Mobile Events Manager < 1.4.8 - Admin+ CSV Injection CVE-2022-1194 8.8 HighSeptember 16, 2022
• mobileeventsmanager mobile events manager Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting CVE-2021-25049 4.8 MediumJanuary 24, 2022
• pixelite events manager Events Manager < 5.9.8 - Cross-Site Scripting (XSS) CVE-2020-35037 6.1 MediumDecember 1, 2021
• pixelite events manager Events Manager < 5.9.8 - Admin+ SQL Injection CVE-2020-35012 7.2 HighDecember 1, 2021