High severity · published Sep 16, 2022
CVE-2022-1194
Mobile Events Manager < 1.4.8 - Admin+ CSV Injection
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mobile Events Manager ·
1.4.8 before 1.4.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1194
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1194
Exploit
https://wpscan.com/vulnerability/62be0991-f095-43cf-a167-3daaed254594
More from Mobile Events Manager
7.5
CVE-2026-88802
MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
4.8
CVE-2021-25049
Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting