623 matches found
WordPress Plugin Essential Addons for Elementor Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2023-6244
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 Pro & 2.2.8 Free. This is due to missing or incorrect nonce validation on the savevirtualeventsettings function. This makes it possibl...
CVE-2023-6242
CVE-2023-6242 is a CSRF vulnerability in the EventON WordPress plugins (EventON and EventON Pro). The flaw arises from missing or incorrect nonce validation in evo_eventpost_update_meta, enabling unauthenticated attackers to forge requests to update arbitrary post metadata. It affects all version...
CVE-2023-6244
CVE-2023-6244 describes a Cross-Site Request Forgery in the EventON WordPress plugin (EventON Pro and EventON Lite). The flaw arises from missing or incorrect nonce validation in the save_virtual_event_settings function, allowing unauthenticated attackers to modify virtual event settings via forg...
CVE-2023-6244 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 Pro & 2.2.8 Free. This is due to missing or incorrect nonce validation on the savevirtualeventsettings function. This makes it possibl...
PT-2024-14909
Name of the Vulnerable Software and Affected Versions The EventON - WordPress Virtual Event Calendar Plugin versions 2.2.7 and earlier for Free The EventON - WordPress Virtual Event Calendar Plugin versions 4.5.4 and earlier for Pro Description The issue is due to missing or incorrect nonce...
CVE-2023-6242: Cross-Site Request Forgery (CSRF)
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 for Pro & 2.2.7 for Free. This is due to missing or incorrect nonce validation on the evoeventpostupdatemeta function. This makes it...
CVE-2023-6244: Cross-Site Request Forgery (CSRF)
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 Pro & 2.2.8 Free. This is due to missing or incorrect nonce validation on the savevirtualeventsettings function. This makes it possibl...
CVE-2023-6158
CVE-2023-6158 (EventON WordPress Plugin) : The vulnerability arises from a missing capability check in evo_eventpost_update_meta, allowing unauthenticated attackers to update and remove arbitrary post metadata. Affected are EventON Pro (versions <= 4.5.4) and EventON (free) (versions
CVE-2023-6158 EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 for Pro and 2.2.7 for free. This make...
CVE-2023-6158: Missing Authorization
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 for Pro and 2.2.7 for free. This make...
CVE-2023-47697
CVE-2023-47697 concerns an unauthenticated reflected Cross-Site Scripting (XSS) in the WordPress WP Event Manager plugin (Events Calendar, Registrations, Sell Tickets with WooCommerce). Public sources consistently identify the vulnerable lineage as WP Event Manager plugin versions up to 3.1.39 (s...
CVE-2023-2407
The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in the lsparsevcitacallback function. This...
CVE-2023-28169 WordPress Easy Event calendar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in CoreFortress Easy Event calendar plugin = 1.0 versions...
CVE-2023-28169: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in CoreFortress Easy Event calendar plugin = 1.0 versions...
PT-2023-21604 · Corefortress · Corefortress Easy Event Calendar Plugin
Name of the Vulnerable Software and Affected Versions: CoreFortress Easy Event calendar plugin versions prior to 1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 1.0...
Wordpress plugin Easy Event calendar 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
WordPress CP Multi View Event Calendar Plugin <= 1.4.10 is vulnerable to Other Vulnerability Type
Software CP Multi View Event Calendar Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.11 OWASP Top 10 A5: Broken Access Control Classification Other Vulnerability Type CVE CVE-2023-28492 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1690516e9658 Credits István Márt...
WordPress Easy Event calendar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software Easy Event calendar Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28169 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1507887cff23 Credits Nithissh S Required...
WordPress CP Multi View Event Calendar Plugin <= 1.4.13 is vulnerable to Broken Access Control
Software CP Multi View Event Calendar Type Plugin Vulnerable versions = 1.4.13 Fixed in 1.4.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23814 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID cf4c806e3e64 Credits yuyudhn Requir...