CVE-2021-25030

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks

Score

CVSS 3.1 8.8 High

Status

Modified - contact@wpscan.com

Published

2022-01-03

Last modified

2024-08-03

Weaknesses

CWE-89

Affected products

• Events Made Easy (E-dynamics)
• Events Made Easy (Unknown)

References

• https://wpscan.com/vulnerability/bc7058b1-ca93-4c45-9ced-7848c7ae4150