Now officially on WordPress.org

CVE Database / CVE-2018-9020

CVE · Medium

CVE-2018-9020 — Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.8.1.2

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-9020 Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 5.8.1.2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.4 < 5.8.1.2 5.8.1.2 2018-03-26 —

CVE-2018-9020

The Events Manager plugin before version 5.8.1.2 contains a stored cross-site scripting vulnerability in its Google Maps functionality. An attacker without administrative privileges who can submit events is able to inject malicious JavaScript into the mapTitle variable in the events-manager.js file, which remains unescaped. When an administrator opens the compromised event, the injected script executes within their browser session. This issue was resolved in version 5.8.1.2 released on January 15, 2018.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings