All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-18057
HIGHpublished 2026-08-12 06:19 UTC · 21 hours ago · modified 2026-08-12 17:17 UTC
8.1
CVSS / 10
// description
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
// weaknesses (CWE)
- CWE-89