CVE-2026-82214

MediumCVSS 5.3/10Last modified Nov 2, 2026

Description

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
UnknownQuick Event Manager>= 8.4.6, < 9.19

References

Timeline

Published
Oct 31, 2026
Last modified
Nov 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-822155.9The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications CVE-2026-822178.8In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContentCVE-2026-82227.5A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsfCVE-2026-822205.3Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.CVE-2026-822217.1Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-8222210.0Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from nCVE-2026-822236.5Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-822247.1Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.CVE-2026-822257.4Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-822269.8Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.CVE-2026-822278.5Contributor SQL Injection in WPBulky <= 1.2.2 versions.CVE-2026-822288.1Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
CVE-2026-82214: Medium severity, CVSS 5.3 | Vulnix