CVE-2026-75963
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.
Risk Assessment
Risk of bypassing access controls, obtaining sensitive data, or achieving code execution if .php uploads are possible.
Recommendation
Update the plugin to the latest version and restrict contributor-level permissions.
Other vulnerabilities in Events Made Easy
See all- CVE-2026-118634Medium
The Events Made Easy plugin for WordPress in versions up to and including 3.3.1 is vulnerable to stored cross-site scripting via the 'width' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.
- CVE-2026-107649Medium
The Events Made Easy plugin for WordPress (versions up to and including 3.2.22) is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off.
- CVE-2026-28162High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.
- CVE-2026-14842Medium
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged. This allows unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
- CVE-2026-14843Medium
The Events Made Easy WordPress plugin before version 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request. It relies only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
- CVE-2026-59557Medium
The Events Made Easy plugin version 3.1.3 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.
Original NVD description (English source)
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS