Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Community Events Project Component: Community Events Clear all filters
TI-2024-05817 CVE-2024-6270 · GHSA-7vjh-vmrf-m55g

Community Events < 1.5.1 - Admin+ Stored XSS

Priority MEDIUM 55

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfi…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00353 Published 2024-08-05 Fixed in 1.5.1 CWE-79
TI-2024-05818 CVE-2024-6271 · GHSA-4mrc-7pp3-99pr

Community Events < 1.5 - Event Deletion via CSRF

Priority MEDIUM 58

The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00272 Published 2024-07-22 Fixed in 1.5 CWE-352
TI-2021-06783 CVE-2021-24496 · GHSA-9g3p-ghhv-vpv9

Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)

Priority LOW 29

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cros…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-08-02 Fixed in 1.4.8 CWE-79