WordPress Subscriber Addons for The Events Calendar plugin < 2.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Subscriber Addons for The Events Calendar plugin versions 2.0.1. Solution Update the WordPress Subscriber Addons for The Events Calendar plugin to the latest available version at least 2.0.1...

WordPress Subscriber Addons for The Events Calendar plugin < 2.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Subscriber Addons for The Events Calendar plugin versions 2.0.1. Solution Update the WordPress Subscriber Addons for The Events Calendar plugin to the latest available version at least 2.0.1...

WordPress Slider Addons for The Events Calendar plugin < 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Slider Addons for The Events Calendar plugin versions 1.0.1. Solution Update the WordPress Slider Addons for The Events Calendar plugin to the latest available version at least 1.0.1...

WordPress The Events Calendar plugin < 5.14.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin < 1.5.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin versions 1.5.8. Solution Update the WordPress Elegant Calendar Lite – WordPress Events Calendar Plugin plugin to the latest available version at least 1.5.8...

WordPress Events Calendar Registration plugin <= 1.9.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Events Calendar Registration plugin versions = 1.9.2. Solution No patched version available...

WordPress The Events Calendar plugin < 5.14.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress The Events Calendar plugin < 5.14.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress The Events Calendar plugin < 5.14.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin versions 5.14.0.4. Solution Update the WordPress The Events Calendar plugin to the latest available version at least 5.14.0.4...

WordPress Modern Events Calendar Lite plugin <= 6.3.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Rohan Chaudhari in WordPress Modern Events Calendar Lite plugin versions = 6.3.0. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 6.4.0...

Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting

The plugin does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks As a contributor, create/edit an Event, add the following payload in a "Hourly Schedule" title, as well as any of...

WordPress Slider Addons for The Events Calendar plugin < 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Slider Addons for The Events Calendar plugin versions 1.0.1. Solution Update the WordPress Slider Addons for The Events Calendar plugin to the latest available version at least 1.0.1...

Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting

The plugin does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, create/edit an Event, add the following payload in a "Hourly Schedule" title, as well as an...

WordPress Events Calendar Registration plugin <= 1.9.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Events Calendar Registration plugin versions = 1.9.2. Solution No patched version available...

The Events Calendar < 5.14.0 - Reflected Cross-Site Scripting

The plugin does not escape an aggregator URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting PoC When there is an Event Aggregator license key active: https://example.com/wp-admin/edit.php?page=tribe-common=importstype=tribeevents&"...

The Events Calendar < 5.14.0 - Reflected Cross-Site Scripting

The plugin does not escape an aggregator URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting When there is an Event Aggregator license key active: https://example.com/wp-admin/edit.php?page=tribe-common&tab=imports&posttype=tribeevents&"alert/XSS/...

WordPress Modern Events Calendar 6.1 SQL Injection

Exploit Title: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection Unauthenticated Date 26.01.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://webnus.net/modern-events-calendar/ Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.6.1.0.zi...

WordPress Modern Events Calendar V 6.1 Plugin - SQL Injection (Unauthenticated) Exploit

Exploit Title: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection Unauthenticated Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://webnus.net/modern-events-calendar/ Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.6.1.0.zip Version: = 6.1...

WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated)

Exploit Title: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection Unauthenticated Date 26.01.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://webnus.net/modern-events-calendar/ Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.6.1.0.zi...

WordPress The Registrations for the Events Calendar plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions of the WordPress plugin The Registrations for the Events...