Public vulnerability disclosure

CVE-2026-82214

publishedCWE-200

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.

Investigate in Cyber JSON Markdown

Technical severity5.3 mediumCVSS 3.1 · NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Published2026-10-31Source updated 2026-11-01

Collected2026-11-021 attributed source

Fixes and workarounds

No remediation reported in collected sources.

Missing remediation information is not evidence that no patch exists.

Affected products and versions

No affected-product ranges reported in collected sources.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 5.3 medium	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`	NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://wpscan.com/vulnerability/b3ccecb9-4544-4944-a31a-f5aed7dcc95e/[email protected]