CVE-2026-14843

The Events Made Easy plugin for WordPress in versions up to and including 3.3.1 is vulnerable to stored cross-site scripting via the 'width' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.

The Events Made Easy plugin for WordPress (versions up to and including 3.2.22) is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.

The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged. This allows unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.

The Events Made Easy plugin version 3.1.3 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.