1102 matches found
CVE-2021-24145
CVE-2021-24145 WordPress File Upload Vulnerability, Modern Events Calendar Lite WordPress plugin before 5.16.5 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 설치 및 실행 순서 1. WordPress 설치 설치를 진행할 때, docker-compose.yml 파일에서 포트포워딩을 진행해주시기 바랍니다. $ docker-compose up 2. WordPress initial & Plugin...
WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...
The Events Calendar < 6.4.0.1 - Cross-site Scripting
The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...
Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting id: CVE-2021-24876 info: name: Registrations for The Events Calendar 2.7.5 - Authenticated Reflected...
WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure
WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...
WordPress Events Calendar <1.4.5 - Cross-Site Scripting
WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...
WordPress Events Calendar 6.8.2.1 - Information Disclosure
The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication. id: CVE-2024-5333 info: name: WordPress Events Calendar 6.8.2.1 - Information Disclosu...
CVE-2026-78159
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-78159 CVE-2026-78159 The Events Calendar 6.17.3 - stellarwp I am @abraxasnull. Loopback lab. The client is CVE-2026-78159-Abraxas-Labs.py. parsearray is the sink, not an ajax action=. Unauthenticated comment...
WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...
CVE-2026-49772
The Events Calendar SQL 인젝션 CVE-2026-49772 PoC 설명 CVE-2026-49772는 WordPress 플러그인 The Events Calendar 의 인증되지 않은 블라인드 SQL 인젝션 입니다. 손상된 REST 매개변수 검증기validatecallback이 검증 대신 클로저를 반환로 인해 실험적 tec/v1 REST API의 order 매개변수가 SQL ORDER BY 절에 검증되지 않은 채 도달합니다: GET /wp-json/tec/v1/events?orderby=eventdate&orde...
CVE-2026-78006-POC
CVE-2026-78006-POC CVE-2026-78006 The Events Calendar !IMPORTANT 이 저장소와 함께 현재 공개된 연구 PoC는 내부적으로 = 6.1...
CVE-2026-84740
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-84740 The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-84740
The Events Calendar WordPress plugin (versions 6.12.0 through 6.17.5 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to validate or sanitise data submitted via an unauthenticated AJAX action, specifically involving the 'view_data' parameter, before i...
EUVD-2026-91210
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
PT-2026-104109
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-97285
Contributor Broken Access Control in The Events Calendar = 6.17.5 versions...
CVE-2024-8275
CVE-2024-8275 CVE-2024-8275는 WordPress 플러그인 The Events Calendar에서 발견된 심각한 SQL 인젝션 취약점입니다. 이 취약점은 버전 6.6.4 이하에 영향을 미칩니다. 문제는 tribehasnextevent 함수의 'order' 매개변수에 대한 이스케이핑이 불충분하여 발생합니다. 입력 값이 적절히 검증되지 않았기 때문에 인증되지 않은 공격자가 악의적인 SQL 쿼리를 추가하여 데이터베이스에 저장된 민감한 정보에 접근할 수 있습니다. 1- Python 설치: Python 3이 설치되어...