CVE-2013-1407

Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.

• CWE-79

• http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.htmlExploit, Patch
• http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-updatePatch, Vendor Advisory
• https://www.htbridge.com/advisory/HTB23139Exploit, Patch
• http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.htmlExploit, Patch
• http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-updatePatch, Vendor Advisory
• https://www.htbridge.com/advisory/HTB23139Exploit, Patch

Published

May 13, 2014

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-1399Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2013-1400Multiple SQL injection vulnerabilities in CWPPoll.js in Word…9.8
• CVE-2013-1401Multiple security bypass vulnerabilities in the editAnswer, …9.8
• CVE-2013-1402DigiLIBE 3.4 and possibly other versions sends a redirect bu…
• CVE-2013-1405VMware vCenter Server 4.0 before Update 4b and 4.1 before Up…
• CVE-2013-1406The Virtual Machine Communication Interface (VMCI) implement…
• CVE-2013-1408Multiple SQL injection vulnerabilities in the Wysija Newslet…
• CVE-2013-1409Cross-site scripting (XSS) vulnerability in the CommentLuv p…
• CVE-2013-1410Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabil…6.1
• CVE-2013-1412DataLife Engine (DLE) 9.7 allows remote attackers to execute…
• CVE-2013-1413Multiple cross-site scripting (XSS) vulnerabilities in synet…
• CVE-2013-1414Multiple cross-site request forgery (CSRF) vulnerabilities i…