EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure

EventPrime WordPress plugin 4.3.6.1 contains a broken access control vulnerability caused by improper handling of Pending Review post status, letting unauthenticated users view non-public content awaiting review, exploit requires no authentication. id: CVE-2026-118523 info: name: EventPrime 4.3.6...

CVE-2026-1657

CVE-2026-1657: Unauthenticated Arbitrary File Upload in EventPrime Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems without...

CVE-2026-118523

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review...

CVE-2026-118523

The EventPrime WordPress plugin (versions before 4.3.6.1 ) contains a vulnerability that fails to keep the built-in Pending Review post status non-public. This flaw allows unauthenticated users to view posts, pages, and other content that are currently awaiting review. This vulnerability falls un...

EUVD-2026-116736

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review...

WordPress EventPrime plugin < 4.3.6.1 - Unauthenticated Pending Post Disclosure vulnerability

Unauthenticated Pending Post Disclosure vulnerability discovered by wellknown.info in WordPress Plugin EventPrime versions 4.3.6.1...

CVE-2026-118523 EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review...

PT-2026-136869

Name of the Vulnerable Software and Affected Versions EventPrime versions prior to 4.3.6.1 Description Broken access control allows unauthenticated users to view posts, pages, and other content that are set to the Pending Review status, which should remain non-public. Recommendations Update...

CVE-2026-42691

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0...

CVE-2026-42691

The EventPrime eventprime-event-calendar-management WordPress plugin (versions

CVE-2026-42691 WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0...

EUVD-2026-112888

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0...

CVE-2026-42691 WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0...

WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin EventPrime versions = 4.3.6.0...

CVE-2026-42691: EventPrime: Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime…

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0...

PT-2026-132197

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0...

WordPress EventPrime authorization issue vulnerability

WordPress EventPrime versions 4.3.6.0 and earlier contain an authorization issue vulnerability. This vulnerability arises from bypassing authorization via user-controlled keys, potentially leading to unauthorized privilege escalation...

CVE-2026-13441

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'neweventtypebackgroundcolor' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-13441

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'neweventtypebackgroundcolor' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-42559

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'neweventtypebackgroundcolor' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible...