Read the docs

Community Events Project

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Community Events Project records in CISA KEV

No Community Events Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Community Events 5 records MEDIUM

Records

5 records

TI-2024-05818 CVE-2024-6271 · GHSA-4mrc-7pp3-99pr

Community Events < 1.5 - Event Deletion via CSRF

Priority MEDIUM 58

The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00272 Published 2024-07-22 Fixed in 1.5 CWE-352
TI-2024-05817 CVE-2024-6270 · GHSA-7vjh-vmrf-m55g

Community Events < 1.5.1 - Admin+ Stored XSS

Priority MEDIUM 55

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfi…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00353 Published 2024-08-05 Fixed in 1.5.1 CWE-79
TI-2021-06783 CVE-2021-24496 · GHSA-9g3p-ghhv-vpv9

Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)

Priority LOW 29

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cros…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-08-02 Fixed in 1.4.8 CWE-79
Open these records in search →