CVE-2026-18366

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.

The Events Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in versions up to and including 7.4.0.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link.

The Events Manager plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 7.3.7.4 via the em_options_save function. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server, leading to code execution or data exposure.

The Events Manager plugin for WordPress is vulnerable to authorization bypass in versions up to and including 7.4.0. Unauthenticated attackers can view titles, dates, descriptions, and location details of events and locations marked as draft, pending, trashed, or private.

The Events Manager plugin for WordPress up to version 7.4.0 is vulnerable to SQL injection via the 'meta_key' parameter in the event/location duplicate action. Attackers with contributor-level access can append additional SQL queries to extract sensitive information from the database.

The Events Manager WordPress plugin before 7.4.1 does not sanitize and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS. This issue affects Events Manager: from n/a through 7.4.2.

The Events Manager WordPress plugin before version 7.3.7 unsafely handles booking-registration data on sites using No-User-Account Booking Mode. A booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query built without parameterization, so an unauthenticated attacker can read arbitrary database data (e.g., user password hashes, secret keys) when the booking is later loaded.

The Events Manager WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 7.3.6.