Description

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-11-06T08:17:38.410Z",
  "pubdate": "2026-11-06T08:17:38.410Z",
  "executiveSummary": "The MDJM Event Management and Mobile Events Manager WordPress plugins, in versions through 1.7.8.7, contain a critical security vulnerability categorized as Stored Cross-Site Scripting (XSS).\nThe flaw originates from an improper authorization and input validation mechanism during the WordPress role creation process.\nAn authenticated user, including those with minimal privileges such as a subscriber, can supply arbitrary data that is processed and stored by the application without sufficient sanitization or security token verification.\nThe primary impact is the execution of malicious web scripts within the administrative context of the WordPress dashboard.\nThis vulnerability poses a significant risk to organizational integrity, as it allows for unauthorized script execution when an administrator accesses the standard user management interface.\nExploitation requires the attacker to hold an authenticated session, though it does not necessitate administrative privileges, making it a high-risk vector for privilege escalation or administrative session compromise through malicious script injection.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of nonce validation and capability checking within the plugin's role creation functionality. In WordPress, critical actions that modify system configurations, such as creating new user roles, should be protected by nonces to prevent Cross-Site Request Forgery (CSRF) and strict capability checks using current_user_can() to ensure only authorized administrators can invoke the function.\nIn the affected versions of the MDJM Event Management and Mobile Events Manager plugins, the application logic accepts a name input from the request and directly utilizes it to create a new WordPress role. By failing to perform these security checks, the plugin allows any authenticated user to trigger the role creation process.\nFurthermore, the plugin fails to perform output encoding or adequate sanitization on the supplied name parameter. When this parameter contains malicious JavaScript, it is persisted in the WordPress database as part of the new role's metadata or name field. This constitutes a Stored XSS vulnerability.\nThe attack flow proceeds as follows: 1) An attacker authenticates as a subscriber. 2) The attacker sends a crafted request to the plugin endpoint responsible for role creation, embedding a malicious script tag in the role name parameter. 3) The application, lacking capability checks, processes the request and persists the unsanitized script into the database. 4) The script remains dormant until an administrator navigates to the WordPress user management dashboard. 5) As the dashboard renders the list of available roles, the stored script is executed within the administrator's browser session.\nBecause the payload executes in the context of an administrator, the attacker can perform unauthorized actions on behalf of the administrator, such as creating new administrative users, modifying plugin settings, or exfiltrating sensitive session cookies via document.cookie access. The vulnerability is persistent, meaning the malicious payload will execute every time the administrative page is loaded until the record is manually removed from the database.\nThis flaw underscores the importance of implementing strict input validation and utilizing WordPress-native security functions to prevent the persistence of malicious data in administrative areas of the application."
}