WordPress plugin Community Events SQL注入漏洞

WordPress Community Events plugin is a plugin that allows users to submit events. Users can publish event information independently through the website form, while the administrator can retain the final right to review the calendar content. A SQL injection vulnerability exists in the WordPress...

WordPress Community Events plugin <= 1.5.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by ifoundbug in WordPress Plugin Community Events versions = 1.5.1...

EUVD-2009-1409

Malware in sbrugna...

EUVD-2019-19017

Malware in sbrugna...

EUVD-2022-47674

Malicious code in bioql PyPI...

CVE-2025-53576 WordPress Ovatheme Events Plugin <= 1.2.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ovatheme Ovatheme Events ova-events allows PHP Local File Inclusion.This issue affects Ovatheme Events: from n/a through = 1.2.8...

CVE-2025-5144

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-6270

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-24376

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Nico Graff WP Simple Events plugin = 1.0 versions...

CVE-2022-44742

Auth. admin+ Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin = 1.4.8 versions...

WordPress MyTicket Events plugin <= 1.2.4 - Non-Arbitrary File Read vulnerability

Non-Arbitrary File Read vulnerability discovered by Anhchangmutrang in WordPress Plugin MyTicket Events versions = 1.2.4...

CVE-2024-13802

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintownevents' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13802 Bandsintown Events <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintownevents' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress SSV Events Plugin <= 3.2.7 is vulnerable to Local File Inclusion

Software SSV Events Type Plugin Vulnerable versions = 3.2.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49286 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID ad40e495904a Credits tahu.datar Required privilege Unauthenticated...

WordPress Community Events plugin < 1.5.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Community Events versions 1.5.1...

CVE-2024-6270

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-37498 · WordPress · Community Events

Name of the Vulnerable Software and Affected Versions: Community Events WordPress plugin versions prior to 1.5.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...

CVE-2023-46189 WordPress Google Calendar Events Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Simple Calendar – Google Calendar Plugin = 3.2.5 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Nico Graff WP Simple Events plugin = 1.0 versions...

CVE-2023-24376 WordPress WP Simple Events Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Nico Graff WP Simple Events plugin = 1.0 versions...