CVE-2024-4665

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce...

CVE-2024-4665

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce...

CVE-2024-4665

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce...

CVE-2024-4665 EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce...

CVE-2024-4665

The EventPrime WordPress plugin (versions prior to 3.5.0 ) contains a vulnerability where it fails to properly validate permissions when updating bookings. This flaw allows a user to change or cancel bookings belonging to other users. Additionally, the feature lacks a nonce , which increases the ...

PT-2025-21476

Name of the Vulnerable Software and Affected Versions: EventPrime WordPress plugin versions prior to 3.5.0 Description: The issue concerns a lack of proper permission validation when updating bookings, allowing users to change or cancel bookings for other users. Additionally, the feature lacks a...

CVE-2024-13526

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the exportsubmittionattendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers,...

CVE-2024-13526

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the exportsubmittionattendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers,...

CVE-2024-13526 EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the exportsubmittionattendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers,...

CVE-2024-13526 EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the exportsubmittionattendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers,...

CVE-2024-13526

CVE-2024-13526 affects the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin. The root cause is missing capability checks in the export_submittion_attendees function across all versions up to 4.0.7.3, enabling authenticated users with Subscriber-level access and higher to downlo...

CVE-2024-12024

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the emticketcategorydata and emticketindividualdata parameters in all versions up to, and including, 4.0.5.3 due to insufficient input sanitization and output escaping. Thi...

CVE-2024-12024

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the emticketcategorydata and emticketindividualdata parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. Thi...

CVE-2024-12024 EventPrime – Events Calendar, Bookings and Tickets <= 4.0.5.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the emticketcategorydata and emticketindividualdata parameters in all versions up to, and including, 4.0.5.3 due to insufficient input sanitization and output escaping. Thi...

CVE-2024-12024

CVE-2024-12024 : EventPrime – Events Calendar, Bookings and Tickets (WordPress) is vulnerable to Stored Cross-Site Scripting via em_ticket_category_data and em_ticket_individual_data in all versions up to and including 4.0.5.3. Exploitation requires the Guest Submissions setting to be enabled. If...

CVE-2024-12024 EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the emticketcategorydata and emticketindividualdata parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. Thi...

WordPress plugin EventPrime 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress EventPrime plugin <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin EventPrime versions = 4.0.4.7...

CVE-2024-9865

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘epbookingattendeefields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-9864

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...