Skip to content
OpenAdvisories

Vendor

mdjm

6 known vulnerabilities.

Products

MDJM Event Management 3 Mobile DJ Manager 3
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2026-15017

    MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers

    The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee…

    mdjm MDJM Event Management Web / CMS
  • High 7.2
    CVE-2026-7537 Public exploit

    MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

    The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploa…

    mdjm MDJM Event Management Web / CMS
  • High 8.8
    CVE-2025-52824

    WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerability

    Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.

    mdjm Mobile DJ Manager
  • High 8.8
    CVE-2025-31074

    WordPress MDJM Event Management plugin <= 1.7.5.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.2.

    mdjm Mobile DJ Manager
  • High 7.1
    CVE-2025-22714

    WordPress MDJM Event Management Plugin <= 1.7.5.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected XSS.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.6.

    mdjm Mobile DJ Manager