CVE-2026-88801

Name of the Vulnerable Software and Affected Versions MDJM Event Management versions prior to 1.7.8.8 Mobile Events Manager versions prior to 1.7.8.8

Description Insufficient input sanitization and output escaping allow authenticated users, such as those with subscriber-level access, to inject arbitrary web scripts. This occurs because the software fails to verify a capability or a nonce before creating a WordPress role from a name provided in the request. The injected scripts execute when an administrator accesses standard user management screens or other affected pages. Stored Cross-Site Scripting (XSS) is a flaw where malicious scripts are permanently stored on the target server.

Recommendations Update MDJM Event Management to version 1.7.8.8 or later. Update Mobile Events Manager to version 1.7.8.8 or later.