{"id":"CVE-2026-88801","title":"MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation","summary":"The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, all…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-79"],"product":"MDJM Event Management","affected":["mdjm_event_management <= 1.7.8.7","mobile_events_manager <= 1.7.8.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-06T11:40:40.649968Z"},"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T11:50:25.576Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88801","references":[{"url":"https://wpscan.com/vulnerability/2b8d19f5-4801-4a53-9001-9e58231e6837/"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T07:47:15.875Z","epss":0.00279,"epssPercentile":0.2041,"slug":"CVE-2026-88801","body":"## Overview\n\nThe MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.\n\n## Affected\n\n- `mdjm_event_management <= 1.7.8.7`\n- `mobile_events_manager <= 1.7.8.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}