Unknown Registrations For The Events Calendar – Event Registration Plugin vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Registrations For The Events Calendar – Event Registration Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2021-25083roundupwpregistrations_for_the_events_calendar+2
EPSS score
0.89%
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting6.1CVE-2021-24876roundupwpregistrations_for_the_events_calendar+2
EPSS score
1.20%
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting9.8CVE-2021-24943roundupwpregistrations_for_the_events_calendar+2
EPSS score
7.30%
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.