CVE-2026-88801: MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The vulnerable plugins do not require a capability check or nonce before creating the role.

Q: When does the injected script execute?

The script is stored in the created role name and executes when an administrator opens a standard WordPress user-management screen.

Q: Are sites affected under default low-privilege account arrangements?

Yes. Because Subscriber-level accounts are sufficient, sites that permit registration or otherwise provide low-privilege accounts may be exposed.

Q: How can administrators look for evidence of exploitation?

Review WordPress roles for unexpected or suspicious role names, particularly names containing script-like or HTML content. The malicious value is stored as the role name.

Published Nov 6, 2026

Updated

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:30 AM

Data Sourced

via MITRE·07:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The vulnerable plugins do not require a capability check or nonce before creating the role.

When does the injected script execute?

The script is stored in the created role name and executes when an administrator opens a standard WordPress user-management screen.

Are sites affected under default low-privilege account arrangements?

Yes. Because Subscriber-level accounts are sufficient, sites that permit registration or otherwise provide low-privilege accounts may be exposed.

How can administrators look for evidence of exploitation?

Review WordPress roles for unexpected or suspicious role names, particularly names containing script-like or HTML content. The malicious value is stored as the role name.

CVE-2026-88801: MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the injected script execute?

Are sites affected under default low-privilege account arrangements?

How can administrators look for evidence of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the injected script execute?

Are sites affected under default low-privilege account arrangements?

How can administrators look for evidence of exploitation?