Fullworksplugins vulnerabilities
14 vulnerabilities
Known vulnerabilities in Fullworksplugins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Quick Event Manager4 vulnerabilities
- Quick Paypal Payments4 vulnerabilities
- Stop User Enumeration3 vulnerabilities
- Quick Contact Form2 vulnerabilities
- Meet My Team1 vulnerabilities
CVE-2025-4302fullworkspluginsstop_user_enumeration+2
EPSS score0.98%
The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path.CVE-2022-47608fullworksquick contact form+2EPSS score0.37%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.CVE-2022-37339fullworksmeet my team (wordpress plugin)+2EPSS score0.52%
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.CVE-2022-46863fullworksquick event manager+2EPSS score0.37%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions.CVE-2017-1000226fullworkspluginsstop_user_enumeration+1EPSS score1.39%
Stop User Enumeration 1.3.8 allows user enumeration via the REST APICVE-2017-18536fullworkspluginsstop_user_enumeration+1EPSS score2.03%
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.CVE-2023-1554fullworkspluginsquick_paypal_payments+2EPSS score0.47%
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2023-25702fullworksquick paypal payments+2EPSS score0.39%
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.CVE-2023-25713fullworksquick paypal payments+2EPSS score0.41%
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.CVE-2023-23974fullworksquick event manager+2EPSS score0.23%
Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).CVE-2023-23889fullworksquick paypal payments+2EPSS score0.36%
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.CVE-2023-23491fullworkspluginsquick_event_manager+1EPSS score1.18%
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.CVE-2023-23979fullworksquick event manager+2EPSS score0.41%
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.CVE-2023-23885fullworksquick contact form+2EPSS score0.39%
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.