Now officially on WordPress.org

CVE Database / CVE-2018-13137

CVE · Medium

CVE-2018-13137 — Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.5

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-13137 Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.9.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 4.8 < 5.9.5 5.9.5 2018-07-18 —

CVE-2018-13137

The Events Manager plugin before version 5.9.5 contains a cross-site scripting vulnerability in the email body settings accessible through the WordPress admin panel. An attacker could inject malicious scripts through the dbem_event_reapproved_email_body parameter when configuring event approval email templates, allowing the injected code to execute in the context of administrative users.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings