title: Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL Injection
description: The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
problem types: CWE-89 SQL Injection
affected:
{
product: Event Manager and Tickets Selling Plugin for WooCommerce
vendor: Unknown
versions:
lessThan: 3.5.8, status: affected, version: 3.5.8, versionType: custom
}