Vulnerabilities

TI-2024-29641 CVE-2024-44052 · GHSA-pf8p-m654-4w75

WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00342 Published 2024-11-01 No fix listed CWE-862

TI-2024-07049 CVE-2024-7605 · GHSA-8584-5866-2gjv

HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update

LOW 20

The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versions up to, and including, 1.1.10.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00427 Published 2024-09-05 No fix listed CWE-862

TI-2024-24992 CVE-2024-37488 · GHSA-hx7r-48g7-4jrp

WordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.9.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00279 Published 2024-07-21 No fix listed CWE-79

Vulnerabilities

Filters

WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability

HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update

WordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability