CVE-2021-25049

4.8 mediumEPSS 0.7%

Medium (4.8) in mobileeventsmanager mobile events manager. EPSS 0.7% chance of exploitation in the next 30 days.

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-01-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mobileeventsmanager:mobile_events_manager

References

https://plugins.trac.wordpress.org/changeset/2647987
https://wpscan.com/vulnerability/227cbf50-59da-4f4c-85da-1959a108ae7e
https://plugins.trac.wordpress.org/changeset/2647987
https://wpscan.com/vulnerability/227cbf50-59da-4f4c-85da-1959a108ae7e

Check your stack JSON