CVE-2020-35037: fallo en Events Manager
Events Manager < 5.9.8 - Cross-Site Scripting (XSS)
Publicada el · Actualizada el
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.9%
probabilidad de explotación
0.9%top 41% de las CVE
explotación observada
noninguna fuente lo reporta
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
Productos afectados
Unknown · Events ManagerCVEs relacionadas — Events Manager
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-35012—Events Manager < 5.9.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2026-18366CRITICALEvents Manager < 7.4.1 - Unauthenticated Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-12987HIGHEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationEPSS 0.5%CVE-2026-18050HIGHEvents Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploadsEPSS 0.4%CVE-2026-18057HIGHEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL InjectionEPSS 0.4%CVE-2026-93662MEDIUMEvents Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' ParameterEPSS 0.2%