CVE-2021-25049: vulnerability in Mobile Events Manager
Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.7%
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected products
Unknown · Mobile Events ManagerRelated CVEs — Mobile Events Manager
In the same product, most dangerous first.
CVE-2022-1194—Mobile Events Manager < 1.4.8 - Admin+ CSV InjectionEPSS 1.3%CVE-2026-88802HIGHMDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post DeletionEPSS 0.4%CVE-2026-88801HIGHMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role CreationEPSS —CVE-2026-88800CRITICALMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role DeletionEPSS —CVE-2026-88799HIGHMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOREPSS —