MDJM EVENT MANAGEMENT · CVE-2026-88801 · Package
NO FIX YET
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 create WordPress roles from a request-supplied name without a capability or nonce check, and store that name unescaped. Any logged-in user, including a subscriber, can inject JavaScript that runs in an administrator's browser when they open the standard user management screens.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the MDJM Event Management or Mobile Events Manager WordPress plugin at version 1.7.8.7 or earlier. Exposure requires any logged-in account, such as a subscriber, so sites with open registration or many low-privilege users are more at risk. Sites without these plugins are not affected.
Not affected if no-public-registration, plugin-not-installed
Who cares mdjm-event-management, mobile-events-manager, wordpress
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.