CVE-2022-3720: The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users

high Affects event-monster (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2022-11-21; advisory modified 2026-06-17.

The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users

Package: event-monster (WordPress plugin) WordPress
Affected versions: <1.2.0
Fixed in: 1.2.0
Severity: high CVSS 7.2
Exploitation: not on CISA KEV · EPSS 1% (64.4th percentile)
Published: 2022-11-21
Source: nvd

References

NVD record event-monster (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-11396 medium The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress same package: event-monster (WordPress plugin)
CVE-2024-1895 high The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress same package: event-monster (WordPress plugin)
CVE-2022-3336 medium The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting vis same package: event-monster (WordPress plugin)
CVE-2022-24086 KEV critical Magento improper input validation vulnerability also from 2022
CVE-2022-39986 critical RaspAP Command Injection vulnerability also from 2022
CVE-2022-24637 critical Improper Privilege Management in Open Web Analytics also from 2022