Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · mobile-dj-manager
Mobile DJ Manager
7 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 13, 2026MDJM Event Management: And the Mobile Events Manager WordPress plugin through 1CVE-2026-88802 · affects up to 1.4.8.3 · fixed in 1.7.8.5 · reported by WPScanHigh 7.5
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
Jul 23, 2026MDJM Event Management: Privilege EscalationCVE-2026-15017 · affects up to 1.7.8.4 · reported by WordfenceHigh 8.8
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities — including `mdjm_employee` and `mdjm_employee_edit` — to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2026MDJM Event Management: Arbitrary File UploadCVE-2026-7537 · affects up to 1.7.8.3 · reported by WordfenceHigh 7.2
The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
Mar 6, 2026MDJM Event Management: Unauthorized data modificationCVE-2026-1650 · affects up to 1.7.8.1 · reported by WordfenceMedium 5.3
The MDJM Event Management plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'custom_fields_controller' function in all versions up to, and including, 1.7.8.1. This makes it possible for unauthenticated attackers to delete arbitrary custom event fields via the 'delete_custom_field' and 'id' parameters.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2025Mobile DJ Manager: Missing AuthorizationCVE-2025-52824 · affects up to 1.7.8.3 · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.
Apr 1, 2025Mobile DJ Manager: Deserialization of Untrusted DataCVE-2025-31074 · affects up to 1.7.5.2 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.2.
Jan 24, 2025Mobile DJ Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22714 · affects up to 1.7.5.6 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected XSS.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.6.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.