Mage People Event Manager And Tickets Selling For Woocommerce vulnerabilities
7 vulnerabilities
Known vulnerabilities in Mage People Event Manager And Tickets Selling For Woocommerce, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-5568mage-peopleevent_manager_and_tickets_selling_for_woocommerce+2
EPSS score0.26%
The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2022-0478mage-peopleevent_manager_and_tickets_selling_for_woocommerce+2EPSS score1.54%
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacksCVE-2024-43138mage-peopleevent_manager_and_tickets_selling_for_woocommerce+2EPSS score0.63%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.CVE-2024-24796mage-peopleevent_manager_and_tickets_selling_for_woocommerce+2EPSS score0.50%
Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: from n/a through 4.1.1.CVE-2023-0144mage-peopleevent_manager_and_tickets_selling_for_woocommerce+2EPSS score0.48%
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2023-36383mage-peopleevent_manager_and_tickets_selling_for_woocommerce+1EPSS score0.33%
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.9.5 versions.CVE-2023-28422mage-peopleevent_manager_and_tickets_selling_for_woocommerce+2EPSS score0.37%
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.