CVE-2024-6271

CVE-2024-6271 affects Community Events WordPress plugin prior to 1.5. The vulnerability is due to a missing CSRF check when deleting events, allowing a CSRF attack to cause a logged-in admin to delete arbitrary events. No exploitation details are provided in the documents. Remediation: upgrade to...

WordPress Community Events Plugin < 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Community Events Type Plugin Vulnerable versions 1.5 Fixed in 1.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6271 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 521f0e010f7a Credits Bob Matyas Required...

Enter the substitute teacher

Welcome to this weeks threat source newsletter with Jon out, youve got me as your substitute teacher. Im taking you back to those halcyon days of youth and that moment when you found out that you had a sub that day, will I be the teacher that just rolls in the TV cart and delivers the single...

WordPress Community Events Plugin < 1.4.8 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:communityeventsproject:communityevents"; if description...

This Week in Spring - August 8th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm baaaaack in the USA for the first time in more than two months, and it feels great to be home! I just concluded a tour of Asia, visiting Taipei, Taiwan Sydney, and the Blue Mountains, in Australia Seoul, S. Korea Singapor...

CVE-2022-44742

Auth. admin+ Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin = 1.4.8 versions...

CVE-2022-44742

Auth. admin+ Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin = 1.4.8 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin = 1.4.8 versions...

CVE-2022-44742

The CVE-2022-44742 entry concerns the WordPress Community Events plugin, affected versions are = 1.4.9) when available, and monitor for updated advisories from the plugin maintainers.

CVE-2022-44742 WordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin = 1.4.8 versions...

WordPress Plugin Lefebvre Community Events 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-14546 · Unknown · Yannick Lefebvre Community Events

Name of the Vulnerable Software and Affected Versions: Yannick Lefebvre Community Events plugin versions = 1.4.8 Description: The issue is related to a Stored Cross-Site Scripting vulnerability that requires authentication with admin+ privileges. Recommendations: For versions = 1.4.8, update to a...

WordPress Community Events plugin <= 1.4.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Hoang Van Hiep sk4rl1ghT in the WordPress Community Events plugin versions = 1.4.8. Solution Update the WordPress Community Events plugin to the latest available version at least 1.4.9...

WordPress The Community Events plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Community Events plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in...

CVE-2021-24496

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in...

CVE-2021-24496

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in...

Cross site scripting

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in...

CVE-2021-24496

Affected software: WordPress Community Events plugin (before 1.4.8). Root cause: the plugin does not sanitize, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page. Impact (as described): reflected Cross‑Site Scripting executed ...

CVE-2021-24496 Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in...

WordPress 插件跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Community Events plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in...