CVE-2023-4251

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

CVE-2023-4250

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-4251

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

CVE-2023-4250

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Cross site request forgery (csrf)

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

Cross site request forgery (csrf)

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

Design/Logic Flaw

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website...

Cross site scripting

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-4250

The CVE-2023-4250 entry concerns the EventPrime WordPress plugin, affected in versions prior to 3.2.0. The root cause is failure to sanitise and escape certain parameters before echoing them in the page, causing a Reflected Cross-Site Scripting (XSS) vulnerability. Impact is described as enabling...

CVE-2023-4250 EventPrime < 3.2.0 - Reflected XSS

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-4250 EventPrime < 3.2.0 - Reflected XSS

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-4251

The CVE-2023-4251 entry concerns the EventPrime WordPress plugin, specifically versions prior to 3.2.0. The issue is a missing CSRF check when creating bookings, allowing an attacker to induce logged-in users to create bookings via CSRF exploitation. Impact is described as enabling unwanted booki...

CVE-2023-4251 EventPrime < 3.2.0 - Booking Creation via CSRF

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

CVE-2023-4251 EventPrime < 3.2.0 - Booking Creation via CSRF

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

CVE-2023-5519 EventPrime < 3.2.0 - Booking Creation via CSRF

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

CVE-2023-5519

The EventPrime WordPress plugin prior to version 3.2.0 lacks CSRF checks for booking creation, enabling CSRF attacks to cause logged-in users to create unwanted bookings. Root cause: missing CSRF validation on the booking endpoint. Impact: potential unauthorized bookings; remediation: upgrade to ...

CVE-2023-5238 EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website...

CVE-2023-5238 EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website...

CVE-2023-5238

The CVE-2023-5238 entry corresponds to the EventPrime WordPress plugin prior to version 3.2.0, where a parameter is not sanitized/escaped before being echoed in the plugin’s search page, causing a reflected HTML injection. Multiple sources (NVD, Red Hat, CVE lists, WPVulndb/PatchStack references)...

CVE-2023-4251: Cross-Site Request Forgery (CSRF)

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...