CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6270 – Community Events < 1.5.1 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-6270
The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/3d0a6edc-61e8-42fb-8b93-ef083146bd9c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6271 – Community Events < 1.5 - Event Deletion via CSRF
https://notcve.org/view.php?id=CVE-2024-6271
The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack El complemento de WordPress Community Events anterior a la versión 1.5 no tiene activada la verificación CSRF al eliminar eventos, lo que podría permitir a los atacantes hacer que un administrador que haya iniciado sesión elimine eventos arbitrarios mediante un ataque CSRF. The Community Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.9. This is due to missing or incorrect nonce validation on the on_show_page() function. This makes it possible for unauthenticated attackers to delete events via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/44d9d085-34cb-490f-a3f5-f9eafae85ab8 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-44742 – WordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-44742
Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions. The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://patchstack.com/database/vulnerability/community-events/wordpress-community-events-plugin-1-4-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24496 – Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24496
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator El plugin Community Events de WordPress versiones anteriores a 1.4.8, no sanea, comprueba ni escapa de sus parámetros GET importrowscount y successimportcount antes de devolverlos a la página de administración, conllevando a un problema de tipo Cross-Site Scripting reflejado que será ejecutado en el contexto de un administrador conectado • https://wpscan.com/vulnerability/5fd1cb7f-a036-4c5b-9557-0ffd4ef6b834 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2015-3313 – Community Events < 1.4 - SQL Injection
https://notcve.org/view.php?id=CVE-2015-3313
SQL injection vulnerability in WordPress Community Events plugin before 1.4. Existe una vulnerabilidad de inyección SQL en el plugin Community Events en versiones anteriores a la 1.4 para WordPress. The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘page_id’ parameter in versions up to, and including, 1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress Community Events plugin version 1.3.5 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/36805 http://packetstormsecurity.com/files/131530/WordPress-Community-Events-1.3.5-SQL-Injection.html http://www.openwall.com/lists/oss-security/2015/04/16/10 http://www.openwall.com/lists/oss-security/2015/05/08/3 http://www.securityfocus.com/bid/74234 https://wordpress.org/plugins/community-events/#developers • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •