Events Made Easy < 1.5.50 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Events Made Easy plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in versions before 1.5.50 due to insufficient input sanitization and output escaping and missing nonce validation. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page if they can successfully trick an admin into performing an action such as clicking on a link.