Unknown Eventprime vulnerabilities
7 vulnerabilities
Known vulnerabilities in Unknown Eventprime, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-4665metagausseventprime+2
EPSS score0.31%
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.CVE-2023-4252metagausseventprime+2EPSS score0.54%
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.CVE-2023-4250metagausseventprime+2EPSS score0.42%
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.CVE-2023-4251metagausseventprime+2EPSS score0.23%
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.CVE-2023-5519metagausseventprime+1EPSS score0.20%
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.CVE-2023-5238metagausseventprime+2EPSS score0.42%
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.CVE-2023-6447metagausseventprime+2EPSS score0.56%
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.