Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: A WP Life Component: Event Monster Clear all filters
TI-2024-10560 CVE-2024-11396 · GHSA-6x4w-fvqp-6jvc

Event monster <= 1.4.3 - Information Exposure Via Visitors List Export

Priority LOW 34

The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02132 Published 2025-01-13 No fix listed CWE-359
TI-2024-01764 CVE-2024-1895 · GHSA-fv5j-c825-8pf5

Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta

Priority LOW 36

The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.9 via deserialization via shortcode of untrusted…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0085 Published 2024-04-30 No fix listed CWE-502
TI-2023-25696 CVE-2023-47525 · GHSA-m4r9-8h98-x643

WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00325 Published 2023-12-21 No fix listed CWE-79
TI-2022-03417 CVE-2022-3720 · GHSA-v727-m7g4-8xpx

Event Monster < 1.2.1 - Admin+ SQLi

Priority HIGH 67

The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01059 Published 2022-11-21 Fixed in 1.2.0
TI-2022-03083 CVE-2022-3336 · GHSA-7mhf-hm4m-p9w6

Event Monster < 1.2.0 - Visitors Deletion via CSRF

Priority MEDIUM 53

The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00301 Published 2022-11-21 Fixed in 1.2.0