{"id":"CVE-2026-88801","kind":"vulnerability","aliases":["CVE-2026-88801"],"related":[],"title":"MDJM Event Management WordPress plugins: subscribers can inject scripts into admin screens","description":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.","summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 create WordPress roles from a request-supplied name without a capability or nonce check, and store that name unescaped. Any logged-in user, including a subscriber, can inject JavaScript that runs in an administrator's browser when they open the standard user management screens.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MDJM Event Management","fixed":[],"affected":"<= 1.7.8.7","ecosystem":"wordpress"}],"ecosystems":[],"tags":["mdjm-event-management","mobile-events-manager","package","wordpress"],"not_affected_if":["no-public-registration","plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check whether MDJM Event Management (slug mobile-dj-manager) or Mobile Events Manager is installed at version 1.7.8.7 or earlier.\n- Check whether the site lets visitors self-register, since any logged-in user (subscriber) can trigger it.\n- Also review Users > Roles/user list for odd role names containing HTML or script.","fix":null,"status":"open","published_at":"2026-11-06T08:17:38+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:31+00:00","updated_at":"2026-11-06T08:43:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MDJM Event Management WordPress plugins: subscribers can inject scripts into admin screens","impact":"medium","summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 create WordPress roles from a request-supplied name without a capability or nonce check, and store that name unescaped. Any logged-in user, including a subscriber, can inject JavaScript that runs in an administrator's browser when they open the standard user management screens.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mdjm-event-management","mobile-events-manager"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected script runs in an administrator's browser session","analyst_note":"Confirm the fixed plugin version from the vendor or WPScan entry at https://nvd.nist.gov/vuln/detail/CVE-2026-88801; no fix version is given in the sources.","how_to_check":"- Check whether the `MDJM Event Management` or `Mobile Events Manager` plugin is installed and its version is `1.7.8.7` or earlier, in the WordPress admin under Plugins.\n- Check whether the site allows self-registration of subscriber accounts, since any authenticated user can trigger the flaw.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-public-registration"],"who_is_affected":"Sites running the MDJM Event Management or Mobile Events Manager WordPress plugin at version 1.7.8.7 or earlier. Exposure requires any logged-in account, such as a subscriber, so sites with open registration or many low-privilege users are more at risk. Sites without these plugins are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4258,"output_tokens":657,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed plugin version from the vendor or WPScan entry at https://nvd.nist.gov/vuln/detail/CVE-2026-88801; no fix version is given in the sources.","search":"'-2026':14A,17A '-88801':15A,18A '1.7.8.7':43B,101C 'admin':11A 'administr':79B,146C 'allow':129C 'arbitrari':139C 'authent':131C 'browser':81B 'capabl':55B,106C 'check':58B,104C 'creat':44B,111C 'cve':13A,16A 'escap':127C 'event':2A,20A,24B,28B,34B,38B,92C,96C 'execut':143C 'includ':69B 'inject':8A,73B,138C 'javascript':74B 'log':66B 'logged-in':65B 'manag':3A,25B,29B,35B,39B,88B,93C,97C,153C 'management':21A 'mdjm':1A,19A,23B,33B,91C 'mdjm-event-manag':22B 'mobil':27B,37B,95C 'mobile-events-manag':26B 'name':52B,62B,117C,125C 'nonc':57B,109C 'one':148C 'open':84B,147C 'packag':30B 'plugin':5A,41B,99C 'request':50B,121C 'request-suppli':49B 'role':46B,114C 'run':76B 'screen':12A,89B,154C 'script':9A,141C 'standard':86B,151C 'store':60B,123C 'subscrib':6A,71B,136C 'suppli':51B,118C 'unescap':63B 'user':68B,87B,132C,152C 'web':140C 'without':53B,126C 'wordpress':4A,31B,40B,45B,98C,113C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MDJM Event Management or Mobile Events Manager WordPress plugin at version 1.7.8.7 or earlier. Exposure requires any logged-in account, such as a subscriber, so sites with open registration or many low-privilege users are more at risk. Sites without these plugins are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["eventmanagement","mdjmeventmanagement"],"ptokens":["event","management","mdjm"],"labels":["high","mdjmeventmanagement","mobileeventsmanager","package","wordpress"],"campaign_type":null,"search_a":"'-2026':14A,17A '-88801':15A,18A 'admin':11A 'cve':13A,16A 'event':2A,20A 'inject':8A 'manag':3A 'management':21A 'mdjm':1A,19A 'plugin':5A 'screen':12A 'script':9A 'subscrib':6A 'wordpress':4A","search_b":"'1.7.8.7':43B 'administr':79B 'browser':81B 'capabl':55B 'check':58B 'creat':44B 'event':24B,28B,34B,38B 'includ':69B 'inject':73B 'javascript':74B 'log':66B 'logged-in':65B 'manag':25B,29B,35B,39B,88B 'mdjm':23B,33B 'mdjm-event-manag':22B 'mobil':27B,37B 'mobile-events-manag':26B 'name':52B,62B 'nonc':57B 'open':84B 'packag':30B 'plugin':41B 'request':50B 'request-suppli':49B 'role':46B 'run':76B 'screen':89B 'standard':86B 'store':60B 'subscrib':71B 'suppli':51B 'unescap':63B 'user':68B,87B 'without':53B 'wordpress':31B,40B,45B","search_c":"'1.7.8.7':101C 'administr':146C 'allow':129C 'arbitrari':139C 'authent':131C 'capabl':106C 'check':104C 'creat':111C 'escap':127C 'event':92C,96C 'execut':143C 'inject':138C 'manag':93C,97C,153C 'mdjm':91C 'mobil':95C 'name':117C,125C 'nonc':109C 'one':148C 'open':147C 'plugin':99C 'request':121C 'role':114C 'screen':154C 'script':141C 'standard':151C 'store':123C 'subscrib':136C 'suppli':118C 'user':132C,152C 'web':140C 'without':126C 'wordpress':98C,113C","first_public_at":"2026-11-06T08:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88801","severity":null,"published_at":"2026-11-06T08:17:38+00:00","modified_at":"2026-11-06T08:17:38+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88801:1875","url":"https://wordpress.org/plugins/mobile-dj-manager/","severity":null,"published_at":"2026-11-06T08:43:54+00:00","modified_at":"2026-11-06T08:43:54+00:00","first_seen_at":"2026-11-06T08:43:54+00:00","fetched_at":"2026-11-06T08:43:54+00:00","note":"No vendor/WPScan advisory found for this CVE. WordPress.org changelog (read) lists 1.7.8.7 as latest release with no entry for this XSS, so no known fixed version; fix left unknown, nothing verified. Affected range <=1.7.8.7 comes from secondary aggregator (HOL Guard); Mobile Events Manager is named there too but I found no primary source for it. Sibling CVEs 88799/88800 same range. Settle by: vendor changelog entry above 1.7.8.7 or WPScan entry.","cites":["https://wordpress.org/plugins/mobile-dj-manager/","https://hol.org/guard/security/cves/CVE-2026-88801-mdjm-event-management-and-mobile-events-manager"]}],"documents":[{"id":84928,"url":"https://wordpress.org/plugins/mobile-dj-manager/","title":"MDJM Event Management - WordPress.org plugin page and changelog (latest 1.7.8.7)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":84936,"url":"https://hol.org/guard/security/cves/CVE-2026-88801-mdjm-event-management-and-mobile-events-manager","title":"HOL Guard: CVE-2026-88801 (fix not reported)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}