WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.11 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Timetable and Event Schedule versions = 2.4.11...

WordPress Timetable and Event Schedule Plugin <= 2.4.11 is vulnerable to SQL Injection

Software Timetable and Event Schedule Type Plugin Vulnerable versions = 2.4.11 Fixed in 2.4.12 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3342 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 0319575418d1 Credits Krzysztof Zając Required privilege...

CVE-2024-3342 Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation ...

CVE-2022-2843

A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument posttitle with the input leads to cross si...

CVE-2022-2844

A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...

Cross site scripting

A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument posttitle with the input leads to cross si...

Cross site scripting

A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...

CVE-2022-2844 MotoPress Timetable and Event Schedule Calendar cross site scripting

A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvcid=1&cpmvcdoaction=mvparse&f=datafeed&calid=1&monthindex=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation...

CVE-2022-2844

CVE-2022-2844 affects MotoPress Timetable and Event Schedule up to 1.4.06. Affects the Calendar Handler component; manipulating Subject/Location/Description via the vulnerable endpoint (the file path in the Description) enables cross-site scripting. Exploitation is described as possible to initia...

CVE-2022-2843

CVE-2022-2843 affects MotoPress Timetable and Event Schedule (WordPress plugin). The vulnerability exists in the Quick Edit path via /wp-admin/admin-ajax.php, where manipulating the post_title parameter with the payload triggers cross-site scripting. Exploitation may be remote. The issue is docu...

CVE-2022-2843 MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting

A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument posttitle with the input leads to cross si...

PT-2022-19030 · Motopress · Motopress Timetable/Event Schedule

Name of the Vulnerable Software and Affected Versions: MotoPress Timetable and Event Schedule versions up to 1.4.06 Description: A vulnerability has been found in the Calendar Handler component of MotoPress Timetable and Event Schedule. The issue affects an unknown part of the file "/wp/?cpmvc...

WordPress plugin MotoPress Timetable and Event Schedule 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin MotoPress Timetable and Event Schedule 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2021-24585

The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts...

CVE-2021-24584

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the editposts capability contributor+ to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...

Default credentials

The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts...

CVE-2021-24584

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the editposts capability contributor+ to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...

CVE-2021-24583

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the editposts capability contributor+ to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...

CVE-2021-24585

CVE-2021-24585 affects the WordPress Timetable and Event Schedule by MotoPress plugin prior to 2.4.0. The vulnerability leaks hashed passwords, usernames, and email addresses (and other less sensitive data) in responses for event timeslot data when requested by a user with edit_posts. Combined wi...