Metagauss Eventprime vulnerabilities, page 2
35 vulnerabilities
Known vulnerabilities in Metagauss Eventprime, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-8369metagausseventprime+2
EPSS score0.35%
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view private or password-protected events.CVE-2026-25312metagausseventprime+1EPSS score0.21%
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.3.CVE-2026-25389metagausseventprime+1EPSS score0.28%
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.CVE-2026-24378metagausseventprime+1EPSS score0.51%
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.CVE-2026-24380metagausseventprime+1EPSS score0.22%
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.0.CVE-2023-4252metagausseventprime+2EPSS score0.54%
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.CVE-2023-4250metagausseventprime+2EPSS score0.42%
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.CVE-2023-4251metagausseventprime+2EPSS score0.23%
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.CVE-2023-5519metagausseventprime+1EPSS score0.20%
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.CVE-2023-5238metagausseventprime+2EPSS score0.42%
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.CVE-2023-45637eventprimeeventprime – events calendar, bookings and tickets+2EPSS score0.51%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 versions.CVE-2023-6447metagausseventprime+2EPSS score0.56%
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.CVE-2023-35884eventprimeeventprime+2EPSS score0.41%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.CVE-2023-33326eventprimeeventprime+2EPSS score0.38%
Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.CVE-2023-33321metagausseventprime+1EPSS score0.52%
Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.