CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2025-39481

CVSS 9.3v3.1pub. 2025-05-16upd. 2026-04-23

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through < 3.11.4.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

  • Imithemes Eventer

    APP
    Imithemes
    ≤ 3.9.6
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2025-0959HIGH8.8ten sam produkt

The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via...

CVE-2025-22635HIGH7.1ten sam produkt

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imitheme...

CVE-2024-11135HIGH7.5ten sam produkt

The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_...

CVE-2025-39482MEDIUM4.3ten sam produkt

Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Acce...

CVE-2024-11134MEDIUM4.3ten sam produkt

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability chec...