{"items":[{"id":"CVE-2025-14945","published":"2026-09-05T05:30:55.833Z","updated":"2026-09-07T11:17:26.343Z","title":"Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes","severity":"MEDIUM","score":5.4,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-14280","published":"2026-08-25T03:27:07.025Z","updated":"2026-08-25T19:22:20.406Z","title":"Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys","severity":"MEDIUM","score":6.6,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.01207,"kevAdded":null},{"id":"CVE-2026-17089","published":"2026-08-25T03:27:06.684Z","updated":"2026-08-25T12:12:47.435Z","title":"Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter","severity":"MEDIUM","score":6.1,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2026-10627","published":"2026-08-25T02:26:48.141Z","updated":"2026-08-27T14:57:35.761Z","title":"Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters","severity":"MEDIUM","score":5.3,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2026-15023","published":"2026-08-25T01:26:44.361Z","updated":"2026-08-25T15:18:18.613Z","title":"Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action","severity":"MEDIUM","score":6.5,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2025-12976","published":"2025-12-18T07:20:45.856Z","updated":"2026-04-08T16:37:31.229Z","title":"Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode","severity":"MEDIUM","score":6.4,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2025-12407","published":"2025-12-12T11:15:51.250Z","updated":"2026-04-08T17:14:10.548Z","title":"Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion","severity":"MEDIUM","score":4.3,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2025-12408","published":"2025-12-12T11:15:50.794Z","updated":"2026-04-08T17:04:23.934Z","title":"Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure","severity":"MEDIUM","score":5.3,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-6976","published":"2025-07-09T22:22:47.733Z","updated":"2026-04-08T17:27:21.447Z","title":"Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes","severity":"MEDIUM","score":6.4,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-6975","published":"2025-07-09T22:22:47.356Z","updated":"2026-04-08T17:17:33.177Z","title":"Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter","severity":"MEDIUM","score":6.1,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2025-6970","published":"2025-07-09T22:22:46.811Z","updated":"2026-04-08T17:00:53.429Z","title":"Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter","severity":"HIGH","score":7.5,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.56369,"kevAdded":null},{"id":"CVE-2024-11260","published":"2025-02-21T05:22:32.400Z","updated":"2026-04-08T17:09:24.080Z","title":"Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter","severity":"HIGH","score":7.5,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00599,"kevAdded":null},{"id":"CVE-2024-5889","published":"2024-06-29T04:33:28.929Z","updated":"2026-04-08T17:01:02.720Z","title":"Events Manager <= 6.4.8 - Reflected Cross-Site Scripting","severity":"MEDIUM","score":6.1,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2024-3492","published":"2024-06-12T11:05:08.700Z","updated":"2026-04-08T17:13:38.373Z","title":"Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes","severity":"MEDIUM","score":6.4,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2024-2110","published":"2024-03-28T02:04:10.937Z","updated":"2026-04-08T17:19:36.730Z","title":"Events Manager <= 6.4.7.1 - Cross-Site Request Forgery","severity":"MEDIUM","score":4.3,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2024-1770","published":"2024-03-28T02:04:09.638Z","updated":"2026-04-08T17:11:48.950Z","title":"Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"HIGH","score":8.8,"vendor":"netweblogic","product":"Meta Tag Manager","kev":false,"epss":0.00813,"kevAdded":null},{"id":"CVE-2024-2111","published":"2024-03-28T02:04:07.161Z","updated":"2026-04-08T17:10:08.122Z","title":"Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"MEDIUM","score":6.4,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2024-0614","published":"2024-03-13T15:26:52.497Z","updated":"2026-04-08T16:57:05.190Z","title":"Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings","severity":"MEDIUM","score":4.4,"vendor":"netweblogic","product":"Events Manager – Calendar, Bookings, Tickets, and more!","kev":false,"epss":0.00679,"kevAdded":null},{"id":"CVE-2018-0576","published":"2018-05-14T13:00:00.000Z","updated":"2024-08-05T03:28:11.133Z","title":"Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML…","severity":"MEDIUM","score":5.4,"vendor":"NetWebLogic","product":"Events Manager","kev":false,"epss":0.01435,"kevAdded":null}]}