CVE-2026-84847
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Unauthenticated Broken Access Control in Quick Event Manager versions up to 9.17.
Risk Assessment
Unauthenticated users could access functions or data they should not, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the plugin to the latest version and perform an access control audit.
Other vulnerabilities in Quick Event Manager
See all- CVE-2026-82214Medium
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export. This allows unauthenticated users to read the content of draft and private posts.
- CVE-2026-84848High
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager versions up to 9.17.
Original NVD description (English source)
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS