CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5059 – WordPress Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure vulnerability
https://notcve.org/view.php?id=CVE-2024-5059
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tickets Booking: from n/a through 1.4.0. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en A WP Life Event Management Tickets Booking. Este problema afecta a Event Management Tickets Booking: desde n/a hasta 1.4.0. The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data. • https://patchstack.com/database/vulnerability/event-monster/wordpress-event-monster-plugin-1-4-0-sensitive-data-exposure-vulnerability?_s_id=cve • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47525 – WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-47525
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2. La neutralización incorrecta de la entrada durante la vulnerabilidad de generación de páginas web ('cross-site Scripting') en A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event permite XSS almacenado. Este problema afecta a Event Monster – Event Management, Tickets Booking, Upcoming Event : desde n/a hasta 1.3.2. The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/event-monster/wordpress-event-monster-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3720 – Event Monster < 1.2.1 - Admin+ SQLi
https://notcve.org/view.php?id=CVE-2022-3720
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users El complemento Event Monster de WordPress anterior a 1.2.0 no valida ni escapa algunos parámetros antes de usarlos en sentencias SQL, lo que podría conducir a una inyección SQL explotable por usuarios con altos privilegios. The Event Monster plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level privileges or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3336 – Event Monster < 1.2.0 - Visitors Deletion via CSRF
https://notcve.org/view.php?id=CVE-2022-3336
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack El complemento Event Monster de WordPress anterior a 1.2.0 no tiene verificación CSRF al eliminar visitantes, lo que podría permitir a los atacantes hacer que el administrador registrado elimine visitantes arbitrarios mediante un ataque CSRF. The Event Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.20. This is due to missing or incorrect nonce validation when processing AJAX actions. This makes it possible for unauthenticated attackers to invoke these actions and perform actions like deleting all visitor records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/57bc6633-1aeb-4c20-a2a5-9b3fa10ba95d • CWE-352: Cross-Site Request Forgery (CSRF) •