Fullworks vulnerabilities

19 vulnerabilities

Known vulnerabilities in Fullworks products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.

Products

9 of 10
6.4CVE-2026-110017fullworksquick paypal payments: payment button & form
EPSS score
0.20%
The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content.8.8CVE-2025-47510fullworksdisplay eventbrite events+1
EPSS score
0.77%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows PHP Local File Inclusion.This issue affects Display Eventbrite Events: from n/a through < 6.3.4.3CVE-2025-27003fullworksquick paypal payments+1
EPSS score
0.13%
Cross-Site Request Forgery (CSRF) vulnerability in fullworks Quick Paypal Payments quick-paypal-payments allows Cross Site Request Forgery.This issue affects Quick Paypal Payments: from n/a through <= 5.7.46.5.9CVE-2022-47608fullworksquick contact form+2
EPSS score
0.37%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.6.3CVE-2022-49745starpluginseasy_age_verify+1239
EPSS score
0.44%
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.6.4CVE-2022-37339fullworksmeet my team (wordpress plugin)+2
EPSS score
0.52%
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.5.9CVE-2022-46863fullworksquick event manager+2
EPSS score
0.37%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions.6.1CVE-2024-13362100pluginsopen_user_map+262
EPSS score
0.28%
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.6.4CVE-2024-10621fullworkssimple shortcode for google maps+1
EPSS score
0.34%
The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.5.3CVE-2026-39535fullworksdisplay eventbrite events+1
EPSS score
0.26%
Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.7.5CVE-2023-25714fullworksquick paypal payments+1
EPSS score
0.76%
Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.5.9CVE-2023-25702fullworksquick paypal payments+2
EPSS score
0.39%
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.7.2CVE-2023-25713fullworksquick paypal payments+2
EPSS score
0.41%
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.6.5CVE-2023-25035fullworksquick contact form+1
EPSS score
0.71%
Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Contact Form : from n/a through 8.0.3.1.6.3CVE-2023-23974fullworksquick event manager+2
EPSS score
0.23%
Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).6.5CVE-2023-23889fullworksquick paypal payments+2
EPSS score
0.36%
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.7.2CVE-2023-23979fullworksquick event manager+2
EPSS score
0.41%
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.6.3CVE-2023-23975fullworksquick event manager+1
EPSS score
0.66%
Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4.6.5CVE-2023-23885fullworksquick contact form+2
EPSS score
0.39%
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.