Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
856 results · page 17 of 18
Aug 2, 2021Calendar Event Multi View: Does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/editCVE-2021-24498 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
- Product
- Calendar Event Multi View
- Fixed in
- 1.4.01
- What to do
- Update Calendar Event Multi View to 1.4.01 or newer.
Aug 2, 2021Community Events: Does not sanitiseCVE-2021-24496 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- Community Events
- Fixed in
- 1.4.8
- What to do
- Update Community Events to 1.4.8 or newer.
Aug 2, 2021Event Geek: Does not sanitise or escape its "Use your own " setting before outputting it in the pageCVE-2021-24480 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting it in the page, leading to an authenticated (admin+) stored Cross-Site Scripting issue
- Product
- Event Geek
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Event Geek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- Fixed in
- 4.10.7.p
- What to do
- Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jun 1, 2021Content Copy Protection & Prevent Image Save: Does not check for CSRFCVE-2021-24333 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.
- Product
- Content Copy Protection & Prevent Image Save
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Content Copy Protection & Prevent Image Save to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021Event Banner: Does not verify the uploaded image fileCVE-2021-24252 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)
- Product
- Event Banner
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Event Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2021Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_fCVE-2021-24149 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.6
- What to do
- Update Modern Events Calendar Lite to 5.16.6 or newer.
Mar 18, 2021Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment fielCVE-2021-24147 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Mar 18, 2021Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, CVE-2021-24146 · WordPress plugins & themes · reported by WPScanHigh 7.5
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Mar 18, 2021Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones tCVE-2021-24145 · WordPress plugins & themes · reported by WPScanHigh 7.2
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 30, 2020The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.CVE-2020-29395 · WordPress plugins & themes · reported by MITREMedium 6.1
The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
- Product
- EventON
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 28, 2020Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticaCVE-2020-9459 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.
- Product
- Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Oct 16, 2019The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided CVE-2019-16523 · WordPress plugins & themes · reported by MITREMedium 5.4
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
- Product
- events-manager
- Affected
- up to 5.9.5
- What to do
- Affects up to 5.9.5. Update events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 8, 2019CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees featureCVE-2019-16120 · WordPress plugins & themes · reported by MITREHigh 8.8
CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
- Product
- CSV injection in the event-tickets (Event Tickets)
- Fixed in
- 4.10.7.2
- What to do
- Update CSV injection in the event-tickets (Event Tickets) to 4.10.7.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 22, 2019The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.CVE-2017-18576 · WordPress plugins & themes · reported by MITREMedium 6.1
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
- Product
- event-notifier
- Fixed in
- 1.2.1
- What to do
- Update event-notifier to 1.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.CVE-2013-7480 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
- Product
- events-manager
- Fixed in
- 5.3.6.1
- What to do
- Update events-manager to 5.3.6.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.CVE-2013-7479 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
- Product
- events-manager
- Fixed in
- 5.3.9
- What to do
- Update events-manager to 5.3.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.CVE-2013-7478 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
- Product
- events-manager
- Fixed in
- 5.5
- What to do
- Update events-manager to 5.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.CVE-2013-7477 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
- Product
- events-manager
- Fixed in
- 5.5.2
- What to do
- Update events-manager to 5.5.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.CVE-2012-6716 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
- Product
- events-manager
- Fixed in
- 5.1.7
- What to do
- Update events-manager to 5.1.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.CVE-2017-18554 · WordPress plugins & themes · reported by MITREMedium 6.1
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
- Product
- analytics-tracker
- Fixed in
- 1.1.1
- What to do
- Update analytics-tracker to 1.1.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-15109 · WordPress plugins & themes · reported by MITREMedium 6.1
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
- Product
- the-events-calendar
- Fixed in
- 4.8.2
- What to do
- Update the-events-calendar to 4.8.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
- Product
- wp-all-import
- Fixed in
- 3.2.4
- What to do
- Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.CVE-2015-9300 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
- Product
- events-manager
- Fixed in
- 5.5.7
- What to do
- Update events-manager to 5.5.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.CVE-2015-9299 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
- Product
- events-manager
- Fixed in
- 5.5.7.1
- What to do
- Update events-manager to 5.5.7.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has code injection.CVE-2015-9298 · WordPress plugins & themes · reported by MITRECritical 9.8
The events-manager plugin before 5.6 for WordPress has code injection.
- Product
- events-manager
- Fixed in
- 5.6
- What to do
- Update events-manager to 5.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 13, 2019The events-manager plugin before 5.6 for WordPress has XSS.CVE-2015-9297 · WordPress plugins & themes · reported by MITREMedium 6.1
The events-manager plugin before 5.6 for WordPress has XSS.
- Product
- events-manager
- Fixed in
- 5.6
- What to do
- Update events-manager to 5.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jul 18, 2019The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.CVE-2016-10763 · WordPress plugins & themes · reported by MITREMedium 4.8
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
- Product
- CampTix Event Ticketing
- Fixed in
- 1.5
- What to do
- Update CampTix Event Ticketing to 1.5 or newer.
Full record and what to do →NVD recordhackerone.comwordpress.org
Jul 18, 2019The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.CVE-2016-10762 · WordPress plugins & themes · reported by MITREHigh 7.5
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
- Product
- CampTix Event Ticketing
- Fixed in
- 1.5
- What to do
- Update CampTix Event Ticketing to 1.5 or newer.
Full record and what to do →NVD recordhackerone.comwordpress.org
May 20, 2019The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.CVE-2019-12241 · WordPress plugins & themes · reported by MITRECritical 9.8
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.
- Affected
- 1.4.5 to 1.4.5
- What to do
- Affects 1.4.5 to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 13, 2019The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or CVE-2018-18872 · WordPress plugins & themes · reported by MITREMedium 5.4
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.
- Product
- Kieran O'Shea Calendar
- Fixed in
- 1.3.11
- What to do
- Update Kieran O'Shea Calendar to 1.3.11 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Apr 12, 2019The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-maCVE-2018-13137 · WordPress plugins & themes · reported by MITREMedium 4.8
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
- Affected
- 5.9.4 to 5.9.4
- What to do
- Affects 5.9.4 to 5.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordansawaf.blogspot.comgist.github.com
Jan 9, 2019Event Calendar WD version 1.1.21 and earlier: Cross-site scriptingCVE-2018-16164 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Event Calendar WD version 1.1.21 and earlier
- Affected
- up to 1.1.21
- What to do
- Affects up to 1.1.21. Update Event Calendar WD version 1.1.21 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
May 14, 2018Events Manager plugin prior to version 5.9 for: Cross-site scriptingCVE-2018-0576 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Events Manager plugin prior to version 5.9 for
- Fixed in
- 5.9
- What to do
- Update Events Manager plugin prior to version 5.9 for to 5.9 or newer.
Mar 25, 2018The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.CVE-2018-9020 · WordPress plugins & themes · reported by MITREMedium 5.4
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
- Product
- Events Manager
- Fixed in
- 5.8.1.2
- What to do
- Update Events Manager to 5.8.1.2 or newer.
Full record and what to do →NVD recordwp-events-plugin.comwordpress.org
Jan 12, 2018The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.CVE-2018-5315 · WordPress plugins & themes · reported by MITRECritical 9.8
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 27, 2017SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recuCVE-2017-14760 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.
- Product
- event-espresso-free (aka Event Espresso Lite)
- Affected
- up to 3.1.37.12.l
- What to do
- Affects up to 3.1.37.12.l. Update event-espresso-free (aka Event Espresso Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsstrunk.comsstrunk.com
Sep 14, 2017Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameterCVE-2017-1002026 · WordPress plugins & themes · reported by larry0@me.comHigh 8.8
Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
- Affected
- 3.1.37.11.l to 3.1.37.11.l
- What to do
- Affects 3.1.37.11.l to 3.1.37.11.l. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the eCVE-2017-1002019 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
- Affected
- 1.02.2 to 1.02.2
- What to do
- Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 14, 2017Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the evCVE-2017-1002018 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
- Affected
- 1.02.2 to 1.02.2
- What to do
- Affects 1.02.2 to 1.02.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 14, 2017Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.CVE-2017-1002017 · WordPress plugins & themes · reported by larry0@me.comMedium 6.1
Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 7, 2017SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-3313 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
- Fixed in
- 1.4
- What to do
- Update the plugin to 1.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Aug 1, 2017The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.CVE-2017-12068 · WordPress plugins & themes · reported by MITREMedium 6.1
The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.
- Affected
- 0.7.9 to 0.7.9
- What to do
- Affects 0.7.9 to 0.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2017Event Calendar WD prior to version 1.0.94: Cross-site scriptingCVE-2017-2224 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Event Calendar WD prior to version 1.0.94 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Event Calendar WD prior to version 1.0.94
- Affected
- up to 1.0.93
- What to do
- Affects up to 1.0.93. Update Event Calendar WD prior to version 1.0.94 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comjvn.jp
Jun 13, 2017SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to CVE-2017-9429 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.
- Product
- Event List
- Affected
- 0.7.8 to 0.7.8
- What to do
- Affects 0.7.8 to 0.7.8. Update Event List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Apr 12, 2017SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendarCVE-2017-7719 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
- Product
- SQL injection in the Spider Event Calendar (aka spider-event-calendar)
- Fixed in
- 1.5.52
- What to do
- Update SQL injection in the Spider Event Calendar (aka spider-event-calendar) to 1.5.52 or newer.
Full record and what to do →NVD recordlists.openwall.netsecurityfocus.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 forCVE-2015-5485 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.
- Fixed in
- 3.10.2
- What to do
- Update the plugin to 3.10.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 3, 2015Spider Event Calendar 1.4.9 for: SQL injectionCVE-2015-2196 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
- Product
- Spider Event Calendar 1.4.9 for
- Affected
- 1.4.9 to 1.4.9
- What to do
- Affects 1.4.9 to 1.4.9. Update Spider Event Calendar 1.4.9 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 4, 2014SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the caliCVE-2014-8586 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter.
- Product
- CP Multi View Event Calendar
- What to do
- Update CP Multi View Event Calendar to the newest version.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-7138 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
- Product
- Cross-site scripting (XSS) vulnerability in the Google Calendar Events
- Fixed in
- 2.0.4
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Google Calendar Events to 2.0.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.