Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
54 results · page 1 of 2
Oct 28, 2026Mage Eventpress: Privilege escalationCVE-2026-109381 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
- Product
- Mage Eventpress
- Affected
- up to 5.7.8
- What to do
- Affects up to 5.7.8. Update Mage Eventpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 26, 2026Mintpay for WooCommerce: Does not verify the authenticity of the payment callback it processesCVE-2026-103381 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.
- Product
- Mintpay for WooCommerce
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Mintpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.CVE-2026-81272 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2026EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2026-13441 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.3.4.2
- What to do
- Affects up to 4.3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2026Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.CVE-2026-56053 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.
- Affected
- up to 4.3.4.1
- What to do
- Affects up to 4.3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.CVE-2026-42687 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.
- Affected
- up to 4.3.2.1
- What to do
- Affects up to 4.3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.CVE-2026-42686 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.
- Affected
- up to 4.3.2.1
- What to do
- Affects up to 4.3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.CVE-2026-39518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
- Affected
- up to 4.3.0.0
- What to do
- Affects up to 4.3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026EventPrime: Missing AuthorizationCVE-2026-42669 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
- Product
- EventPrime
- Affected
- up to 4.3.2.0
- What to do
- Affects up to 4.3.2.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026EventPress: Does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the responseCVE-2026-6268 · WordPress plugins & themes · reported by WPScanHigh 7.1
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
- Product
- EventPress
- Fixed in
- 22.2
- What to do
- Update EventPress to 22.2 or newer.
Mar 25, 2026EventPrime: Deserialization of Untrusted DataCVE-2026-24378 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
- Product
- EventPrime
- Affected
- up to 4.2.8.0
- What to do
- Affects up to 4.2.8.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026EventPrime: Missing AuthorizationCVE-2025-69358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.6.0.
- Product
- EventPrime
- Affected
- up to 4.2.6.0
- What to do
- Affects up to 4.2.6.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026EventPrime: Missing AuthorizationCVE-2026-25312 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.3.
- Product
- EventPrime
- Affected
- up to 4.2.8.3
- What to do
- Affects up to 4.2.8.3. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026EventPrime: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25389 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.
- Product
- EventPrime
- Affected
- up to 4.2.8.3
- What to do
- Affects up to 4.2.8.3. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2026EventPrime: Unauthorized post modificationCVE-2026-1655 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4. This is due to the save_frontend_event_submission function accepting a user-controlled event_id parameter and updating the corresponding event post without enforcing ownership or capability checks. This makes it possible for authenticated (Customer+) attackers to modify posts created by administrators by manipulating the event_id parameter granted they can obtain a valid nonce.
- Product
- EventPrime
- Affected
- up to 4.2.8.4
- What to do
- Affects up to 4.2.8.4. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2026EventPrime: Unauthorized image file uploadCVE-2026-1657 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implementing any authentication, authorization, or nonce verification despite a nonce being created. This makes it possible for unauthenticated attackers to upload image files to the WordPress uploads directory and create Media Library attachments via the ep_upload_file_media endpoint.
- Product
- EventPrime
- Affected
- up to 4.2.8.4
- What to do
- Affects up to 4.2.8.4. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026EventPrime: Missing AuthorizationCVE-2026-24380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.0.
- Product
- EventPrime
- Affected
- up to 4.2.8.0
- What to do
- Affects up to 4.2.8.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2026EventPrime - Events Calendar, Bookings and Tickets: Sensitive Information ExposureCVE-2025-14507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
- Product
- EventPrime - Events Calendar, Bookings and Tickets
- Affected
- up to 4.2.7.0
- What to do
- Affects up to 4.2.7.0. Update EventPrime - Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025EventPrime: Insertion of Sensitive Information Into Sent DataCVE-2025-63007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.4.1.
- Product
- EventPrime
- Affected
- up to 4.2.4.1
- What to do
- Affects up to 4.2.4.1. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025EventPrime: Missing AuthorizationCVE-2025-63006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.4.1.
- Product
- EventPrime
- Affected
- up to 4.2.4.1
- What to do
- Affects up to 4.2.4.1. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized booking note creationCVE-2025-12498 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.2.0.0
- What to do
- Affects up to 4.2.0.0. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2025EventPrime: Does not properly validate permissionsCVE-2024-4665 · WordPress plugins & themes · reported by WPScanMedium 6.4
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.
- Product
- EventPrime
- Fixed in
- 3.5.0
- What to do
- Update EventPrime to 3.5.0 or newer.
Mar 11, 2025Frontpage category filter: Cross-Site Request Forgery (CSRF)CVE-2025-28867 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue affects Frontpage category filter: from n/a through <= 1.0.2.
- Product
- Frontpage category filter
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Frontpage category filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-13526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.7.3
- What to do
- Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 3, 2025ntp-header-images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nord_tramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through <= 1.2.
- Product
- ntp-header-images
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update ntp-header-images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025ApplicantPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23920 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sourcing Team ApplicantPro applicantpro allows Reflected XSS.This issue affects ApplicantPro: from n/a through <= 1.3.9.
- Product
- ApplicantPro
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update ApplicantPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024KinTPV WooConnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinhelios KinTPV WooConnect kintpv-connect allows Stored XSS.This issue affects KinTPV WooConnect: from n/a through <= 8.129.
- Product
- KinTPV WooConnect
- Affected
- up to 8.129
- What to do
- Affects up to 8.129. Update KinTPV WooConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-12024 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em_ticket_individual_data parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page. Note: this vulnerability requires the "Guest Submissions" setting to be enabled. It is disabled by default.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.7.3
- What to do
- Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024EventPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51861 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek EventPress wp-eventpress allows Stored XSS.This issue affects EventPress: from n/a through <= 1.0.0.
- Product
- EventPress
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update EventPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024EventPrime: Missing AuthorizationCVE-2024-43223 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.0.3.2.
- Product
- EventPrime
- Affected
- up to 4.0.3.2
- What to do
- Affects up to 4.0.3.2. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024DocumentPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment DocumentPress documentpress-display-any-document-on-your-site allows Reflected XSS.This issue affects DocumentPress: from n/a through <= 2.1.
- Product
- DocumentPress
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update DocumentPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-9865 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the transaction log for a booking.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.4.7
- What to do
- Affects up to 4.0.4.7. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-9864 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when front-end users can submit new events with tickets.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.4.7
- What to do
- Affects up to 4.0.4.7. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2024EventPrime: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47648 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: from n/a through <= 4.0.4.5.
- Product
- EventPrime
- Affected
- up to 4.0.4.5
- What to do
- Affects up to 4.0.4.5. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access to Private or Password-protected eventsCVE-2024-8369 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view private or password-protected events.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.4.3
- What to do
- Affects up to 4.0.4.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jun 9, 2024EventPrime: Missing AuthorizationCVE-2024-31275 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.
- Product
- EventPrime
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024EventPrime: Missing AuthorizationCVE-2023-33321 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.
- Product
- EventPrime
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2024EventPrime: Cross Site Scripting (XSS)CVE-2024-29776 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
- Product
- EventPrime
- Affected
- up to 3.3.9
- What to do
- Affects up to 3.3.9. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 23, 2024EventPrime: Missing AuthorizationCVE-2024-24832 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
- Product
- EventPrime
- Affected
- up to 3.3.9
- What to do
- Affects up to 3.3.9. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Payment bypassCVE-2024-1321 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-1127 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the booking_export_all() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all event booking which can contain PII.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-1126 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_attendees_email_by_event_id() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to to retrieve the attendees list for any event.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-1320 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_status' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized loss of dataCVE-2024-1125 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized email sendingCVE-2024-1124 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized modification of dataCVE-2024-1123 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 31, 2024Frontpage Manager: Cross-Site Request Forgery (CSRF)CVE-2024-22285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3.
- Product
- Frontpage Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Frontpage Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 22, 2024EventPrime: Lacks authentication and authorizationCVE-2023-6447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.
- Product
- EventPrime
- Fixed in
- 3.3.6
- What to do
- Update EventPrime to 3.3.6 or newer.
Nov 27, 2023EventPrime: Specifies the price of a booking in the client requestCVE-2023-4252 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
- Product
- EventPrime
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2023EventPrime: Does not have CSRF checksCVE-2023-5519 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
- Product
- EventPrime
- Fixed in
- 3.2.0
- What to do
- Update EventPrime to 3.2.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.