44 matches found
CVE-2025-32509 WordPress Simple WP Events plugin <= 1.8.17 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through = 1.8.17...
CVE-2025-32509
CVE-2025-32509 affects WordPress plugin Simple WP Events (versions ≤ 1.8.17). The issue is an improper limitation of a pathname to a restricted directory, i.e., a path traversal vulnerability. Some connected sources also indicate the underlying impact as arbitrary file deletion. The vulnerability...
CVE-2025-32509 WordPress Simple WP Events plugin <= 1.8.17 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPMinds Simple WP Events allows Path Traversal. This issue affects Simple WP Events: from n/a through 1.8.17...
PT-2025-16053 · Wpminds · Wpminds Simple Wp Events
Name of the Vulnerable Software and Affected Versions: WPMinds Simple WP Events versions 1.8.17 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows an attacker to traverse the file system and...
CVE-2025-2004 Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion
The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpedeletefile AJAX action in all versions up to, and including, 1.8.17. This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...
CVE-2025-2004
CVE-2025-2004 affects Simple WP Events for WordPress. Unauthenticated attackers can delete arbitrary files via wpe_delete_file due to insufficient file path validation in all versions up to 1.8.17, with possible remote code execution if critical files (e.g., wp-config.php) are removed. The Wordfe...
CVE-2025-2004 Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion
The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpedeletefile AJAX action in all versions up to, and including, 1.8.17. This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...
WordPress plugin Simple WP Events 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2025-15333 · WordPress · Simple Wp Events
Name of the Vulnerable Software and Affected Versions: Simple WP Events plugin for WordPress versions up to and including 1.8.17 Description: The issue arises from insufficient file path validation in the wpe delete file AJAX action, allowing unauthenticated attackers to delete arbitrary files on...
CVE-2025-32193
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMinds Simple WP Events simple-wp-events allows Stored XSS.This issue affects Simple WP Events: from n/a through = 1.8.17...
CVE-2025-32193
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMinds Simple WP Events simple-wp-events allows Stored XSS.This issue affects Simple WP Events: from n/a through = 1.8.17...
CVE-2025-32193 WordPress Simple WP Events plugin <= 1.8.17 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMinds Simple WP Events simple-wp-events allows Stored XSS.This issue affects Simple WP Events: from n/a through = 1.8.17...
CVE-2025-32193 WordPress Simple WP Events plugin <= 1.8.17 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMinds Simple WP Events simple-wp-events allows Stored XSS.This issue affects Simple WP Events: from n/a through = 1.8.17...
CVE-2025-32193
CVE-2025-32193 concerns the WordPress plug-in Simple WP Events (vulnerable up to and including 1.8.17). The issue is an stored Cross-Site Scripting (XSS) vulnerability described as an improper neutralization of input during web page generation . The CVE metadata shows a CVSS 3.1 base score of 6.5...
WordPress Simple WP Events plugin <= 1.8.17 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Simple WP Events versions = 1.8.17...
WordPress plugin Simple WP Events 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-7717
CVE-2024-7717 – In WP Events Manager for WordPress, there is a time-based SQL Injection in the order parameter affecting all versions up to 2.1.11. Exploitation requires Subscriber+ level authentication and can cause injection of additional SQL to extract sensitive data. According to connected RH...
WordPress WP Events Calendar plugin <= 1.0 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability found by Ozkan Mustafa Akkus in premium WordPress WP Events Calendar plugin versions = 1.0. An attacker can perform attacks via calendar ajax queries. However, this plugin is fully PHP-enabled. You can run SQL query with "month" and "year" parameters. Solution 5...
