What’s Vulnerable › Vulnerabilities

CVE-2022-3720: Event Monster < 1.2.1 - Admin+ SQLi

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-11-21 · updated 2026-06-17

Description

The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users

Affected products

• Event Monster: before 1.2.0 — fixed in 1.2.0

How to fix

Upgrade to a fixed version: Event Monster 1.2.0. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5
• https://wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5

Get alerted when CVE-2022-3720 or the next vulnerability affects your stack