Lucene search
PRIOn knowledge basePRION:CVE-2023-6158HistoryJan 10, 2024 - 3:15 p.m.
Design/Logic Flaw
2024-01-1015:15:00
PRIOn knowledge base
www.prio-n.com
8
eventon
wordpress
virtual event
calendar
plugin
vulnerability
unauthorized modification
data loss
missing capability check
unauthenticated attackers
arbitrary post metadata
content injection
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection.
| CPE | Name | Operator | Version |
|---|---|---|---|
| eventon | le | 4.5.4 | |
| eventon-lite | le | 2.2.7 |
Related
nvd
nvd
CVE-2023-6158
2024-01-10 15:15:10
cve
cve
CVE-2023-6158
2024-01-10 15:15:10
cvelist
cvelist
CVE-2023-6158
2024-01-10 14:32:07
wordfence
wordfence