CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8016 – The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-8016
The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In certain configurations, this can be exploitable by lower level users. We confirmed that this plugin installed with Elementor makes it possible for users with contributor-level access and above to exploit this issue. • https://theeventscalendar.com/blog/news/important-security-update-for-the-events-calendar-pro https://theeventscalendar.com/release-notes/events-calendar-pro/events-calendar-pro-7-0-2-1 https://www.wordfence.com/threat-intel/vulnerabilities/id/34f0e5a6-0bd3-4734-b7e0-27dc825d193f?source=cve • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2261 – Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure
https://notcve.org/view.php?id=CVE-2024-2261
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses. El complemento Event Tickets and Registration para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 5.8.2 incluida a través de la funcionalidad RSVP. Esto hace posible que los atacantes autenticados, con acceso de colaborador y superior, extraigan datos confidenciales, incluidos correos electrónicos y direcciones postales. • https://plugins.trac.wordpress.org/changeset?old_path=/event-tickets/tags/5.8.2&old=3059268&new_path=/event-tickets/tags/5.8.3&new=3059268&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/2e42dd1c-adf7-471a-a14a-9038c56413a2?source=cve • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1053 – Event Tickets and Registration <= 5.8.1 - Missing Authorization
https://notcve.org/view.php?id=CVE-2024-1053
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves. El complemento Event Tickets and Registration para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificación de capacidad en la acción 'email' en todas las versiones hasta la 5.8.1 incluida. Esto hace posible que los atacantes autenticados, con acceso de nivel de colaborador y superior, se envíen por correo electrónico la lista de asistentes. • https://plugins.trac.wordpress.org/changeset/3038150/event-tickets/tags/5.8.2/src/Tickets/Commerce/Reports/Attendees.php https://www.wordfence.com/threat-intel/vulnerabilities/id/a7839847-2637-4a0d-bfc1-5f80b8433e24?source=cve • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25025 – Event Calendar < 1.1.51 - Subscriber+ Event Creation
https://notcve.org/view.php?id=CVE-2021-25025
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events El plugin EventCalendar de WordPress versiones anteriores a 1.1.51, no presenta una autorización adecuada y comprobaciones CSRF en las acciones add_calendar_event AJAX, permitiendo a los usuarios con un rol tan bajo como el de suscriptor crear eventos • https://wpscan.com/vulnerability/24fb4eb4-9fe1-4433-8844-8904eaf13c0e • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25024 – Event Calendar < 1.1.51 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25024
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues El plugin EventCalendar de WordPress versiones anteriores a 1.1.51, no escapa a algunas entradas del usuario antes de devolverlas en atributos, conllevando a problemas de tipo Cross-SIte Scripting Reflejado • https://wpscan.com/vulnerability/08864b76-d898-4dfe-970d-d7cc1b1115a7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •