Threats tagged 'ghsa-458f-8h9v-25hw'

The MDJM Event Management and Mobile Events Manager WordPress plugins up to version 1.7.8.7 contain a vulnerability where they fail to verify user capabilities or nonces before creating WordPress roles from user-supplied names. This flaw allows any authenticated user, including subscribers, to inject arbitrary web scripts that execute when an administrator views user management screens.