Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
343 results · page 7 of 7
Apr 14, 2022Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1CVE-2022-27848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 21, 2022Modern Events Calendar Lite: Does not sanitize and escape some of the Hourly Schedule parametersCVE-2022-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.4.0
- What to do
- Update Modern Events Calendar Lite to 6.4.0 or newer.
Jan 24, 2022Registrations for the Events Calendar: Does not escape the qtype parameter before outputting it back in an attribute in the settings pageCVE-2021-25083 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.10
- What to do
- Update Registrations for the Events Calendar to 2.7.10 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Mobile Events Manager: Does not sanitise and escape various of its settingsCVE-2021-25049 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Mobile Events Manager
- Fixed in
- 1.4.4
- What to do
- Update Mobile Events Manager to 1.4.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 17, 2022Modern Events Calendar Lite: Alloed any logged-in userCVE-2021-25046 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.2.0
- What to do
- Update Modern Events Calendar Lite to 6.2.0 or newer.
Jan 3, 2022Events Made Easy: Does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX actionCVE-2021-25030 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks
- Product
- Events Made Easy
- Fixed in
- 2.2.36
- What to do
- Update Events Made Easy to 2.2.36 or newer.
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Tickera
- Fixed in
- 3.4.8.3
- What to do
- Update Tickera to 3.4.8.3 or newer.
Dec 21, 2021SportsPress: Does not sanitise and escape its match_day parameter before outputting back in the Events backend pageCVE-2021-24578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue
- Product
- SportsPress
- Fixed in
- 2.7.9
- What to do
- Update SportsPress to 2.7.9 or newer.
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.6
- What to do
- Update Registrations for the Events Calendar to 2.7.6 or newer.
Dec 1, 2021Events Manager: Does not sanitise and escape some search parameter before outputing them in pagesCVE-2020-35037 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
- Product
- Events Manager
- Fixed in
- 5.9.8
- What to do
- Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 1, 2021Events Manager: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2020-35012 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection
- Product
- Events Manager
- Fixed in
- 5.9.8
- What to do
- Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.5
- What to do
- Update Registrations for the Events Calendar to 2.7.5 or newer.
Nov 1, 2021Events Made Easy: Does not sanitise and escape Custom Field NamesCVE-2021-24813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Events Made Easy
- Fixed in
- 2.2.24
- What to do
- Update Events Made Easy to 2.2.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.3
- What to do
- Update Modern Events Calendar Lite to 5.22.3 or newer.
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.2
- What to do
- Update Modern Events Calendar Lite to 5.22.2 or newer.
Aug 23, 2021Simple Events Calendar: Does not sanitiseCVE-2021-24552 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue
- Product
- Simple Events Calendar
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Simple Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021Community Events: Does not sanitiseCVE-2021-24496 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- Community Events
- Fixed in
- 1.4.8
- What to do
- Update Community Events to 1.4.8 or newer.
Mar 18, 2021Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_fCVE-2021-24149 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.6
- What to do
- Update Modern Events Calendar Lite to 5.16.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment fielCVE-2021-24147 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Mar 18, 2021Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, CVE-2021-24146 · WordPress plugins & themes · reported by WPScanHigh 7.5
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Mar 18, 2021Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones tCVE-2021-24145 · WordPress plugins & themes · reported by WPScanHigh 7.2
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 28, 2020Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticaCVE-2020-9459 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
- Product
- Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Oct 16, 2019The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided CVE-2019-16523 · WordPress plugins & themes · reported by MITREMedium 5.4
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
- Product
- events-manager
- Affected
- up to 5.9.5
- What to do
- Affects up to 5.9.5. Update events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comgithub.com
Aug 22, 2019The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.CVE-2013-7480 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
- Product
- events-manager
- Fixed in
- 5.3.6.1
- What to do
- Update events-manager to 5.3.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
- Product
- events-manager
- Fixed in
- 5.3.9
- What to do
- Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.CVE-2013-7478 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
- Product
- events-manager
- Fixed in
- 5.5
- What to do
- Update events-manager to 5.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.CVE-2013-7477 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
- Product
- events-manager
- Fixed in
- 5.5.2
- What to do
- Update events-manager to 5.5.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.CVE-2012-6716 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
- Product
- events-manager
- Fixed in
- 5.1.7
- What to do
- Update events-manager to 5.1.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-15109 · WordPress plugins & themes · reported by MITREMedium 6.1
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
- Product
- the-events-calendar
- Fixed in
- 4.8.2
- What to do
- Update the-events-calendar to 4.8.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 13, 2019The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.CVE-2015-9300 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
- Product
- events-manager
- Fixed in
- 5.5.7
- What to do
- Update events-manager to 5.5.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.CVE-2015-9299 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
- Product
- events-manager
- Fixed in
- 5.5.7.1
- What to do
- Update events-manager to 5.5.7.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8
The events-manager plugin before 5.6 for WordPress has code injection.
- Product
- events-manager
- Fixed in
- 5.6
- What to do
- Update events-manager to 5.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has XSS.CVE-2015-9297 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.6 for WordPress has XSS.
- Product
- events-manager
- Fixed in
- 5.6
- What to do
- Update events-manager to 5.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Apr 12, 2019The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-maCVE-2018-13137 · WordPress plugins & themes · reported by MITREMedium 4.8
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
- Affected
- 5.9.4 to 5.9.4
- What to do
- Affects 5.9.4 to 5.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comgist.github.com
May 14, 2018Events Manager plugin prior to version 5.9 for: Cross-site scriptingCVE-2018-0576 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Events Manager plugin prior to version 5.9 for
- Fixed in
- 5.9
- What to do
- Update Events Manager plugin prior to version 5.9 for to 5.9 or newer.
Mar 25, 2018The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.CVE-2018-9020 · WordPress plugins & themes · reported by MITREMedium 5.4
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
- Product
- Events Manager
- Fixed in
- 5.8.1.2
- What to do
- Update Events Manager to 5.8.1.2 or newer.
Full record and what to do →NVD recordwp-events-plugin.comwordpress.org
Jan 12, 2018The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.CVE-2018-5315 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 7, 2017SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-3313 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
- Fixed in
- 1.4
- What to do
- Update the plugin to 1.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 forCVE-2015-5485 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.
- Fixed in
- 3.10.2
- What to do
- Update the plugin to 3.10.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-7138 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Google Calendar Events
- Fixed in
- 2.0.4
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Google Calendar Events to 2.0.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
May 13, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remCVE-2013-1407 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro
- Fixed in
- 5.3.5
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro to 5.3.5 or newer.
Full record and what to do →NVD recordarchives.neohapsis.comwp-events-plugin.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.