CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5889 – Events Manager <= 6.4.8 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-5889
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. El complemento Events Manager – Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a Cross-Site Scripting Reflejado a través del parámetro 'país' en todas las versiones hasta la 6.4.8 incluida debido a una sanitización de entrada y un escape de salida insuficientes. • https://plugins.trac.wordpress.org/changeset/3106809 https://www.wordfence.com/threat-intel/vulnerabilities/id/73cbb65e-b4e3-4374-9916-9a3d1be5a014?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3492 – Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes
https://notcve.org/view.php?id=CVE-2024-3492
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'location', and 'event_category' shortcodes in all versions up to, and including, 6.4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Events Manager – Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a Cross-Site Scripting Almacenado a través de los códigos cortos 'evento', 'ubicación' y 'categoría_evento' del complemento en todas las versiones hasta la 6.4.7.3 incluida debido a una sanitización de entrada insuficiente y a un escape de salida proporcionado por los atributos de usuario. • https://plugins.trac.wordpress.org/changeset/3101326/events-manager https://www.wordfence.com/threat-intel/vulnerabilities/id/a767f65e-bc7d-4576-af78-b77bd23dc089?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-2110 – Events Manager <= 6.4.7.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2024-2110
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers to modify booking statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento Events Manager – Calendar, Bookings, Tickets, and more! • https://github.com/Alaatk/CVE-2024-21107 https://plugins.trac.wordpress.org/changeset/3054883/events-manager/trunk/classes/em-bookings-table.php https://www.wordfence.com/threat-intel/vulnerabilities/id/c0538999-0a09-4d24-a530-a32fb5b4e5e6?source=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1770 – Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection
https://notcve.org/view.php?id=CVE-2024-1770
The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the get_post_data function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. El complemento Meta Tag Manager para WordPress es vulnerable a la inyección de objetos PHP en todas las versiones hasta la 3.0.2 incluida a través de la deserialización de entradas que no son de confianza en la función get_post_data. • https://plugins.trac.wordpress.org/changeset/3054910/meta-tag-manager/trunk/meta-tag-manager.php https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec1aed2-d299-4fa9-add6-10b63ed6aa30?source=cve • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 3CVE-2024-2111 – Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-2111
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Events Manager – Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a cross-site scripting almacenado a través del valor de ubicación física en todas las versiones hasta la 6.4.7.1 incluida debido a una sanitización de entrada y un escape de salida insuficientes. • https://github.com/mansk1es/CVE-2024-21111 https://github.com/x0rsys/CVE-2024-21111 https://github.com/10cks/CVE-2024-21111-del https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3054883%40events-manager&new=3054883%40events-manager&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/95ded4bf-9964-4bb3-b6e5-5ad37360f87d?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •