CVE-2020-35012

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection

Score

CVSS 3.1 7.2 High

Status

Modified - contact@wpscan.com

Published

2021-12-01

Last modified

2024-08-04

Weaknesses

CWE-89

Affected products

• Events Manager (Pixelite)
• Events Manager (Unknown)

References

• https://plugins.trac.wordpress.org/changeset/2336019/events-manager
• https://wpscan.com/vulnerability/323140b1-66c4-4e7d-85a4-1c922e40866f