CVE-2026-82214

MediumCVSS 5.3

Published: 31/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export. This allows unauthenticated users to read the content of draft and private posts.

Risk Assessment

Unauthenticated users can access confidential content such as private and draft posts, potentially leading to information disclosure. This may compromise the confidentiality of organizational or user data.

Recommendation

Update the Quick Event Manager plugin to version 9.19 or later. Check whether private and draft posts have been exposed.

Other vulnerabilities in Quick Event Manager

See all

Original NVD description (English source)

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS