CVE-2026-121636

MediumCVSS 5.3/10Last modified Nov 6, 2026

Description

The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Unknown	Quick Event Manager	>= 9.9.5, < 9.19

References

https://wpscan.com/vulnerability/04b181e1-639c-476f-b66b-2a073bf36829/

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1216378.9An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who CVE-2026-1216389.1An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to inte CVE-2026-1216399.2A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with n CVE-2026-121644.4Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective per CVE-2026-1216409.1An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate re CVE-2026-121658.8The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in a CVE-2026-1216525.4Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitra CVE-2026-1216539.8SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code CVE-2026-121665.5A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of ser CVE-2026-1216607.5Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216617.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1216628.6Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to