Vulnerabilities

TI-2023-09766 CVE-2023-23979 · GHSA-734q-pq52-4w9r

WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00406 Published 2023-04-06 No fix listed CWE-79

TI-2022-23207 CVE-2022-46863 · GHSA-7pwg-6h7v-4x3q

WordPress Quick Event Manager Plugin <= 9.6.4 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-03-28 No fix listed CWE-79

TI-2023-09761 CVE-2023-23974 · GHSA-v6rp-x972-g5w7

WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 24

Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00234 Published 2023-03-01 No fix listed CWE-352

TI-2023-09326 CVE-2023-23491 · GHSA-8vf4-cp85-x9v7

Cross-site scripting in Quick Event Manager WordPress Plugin

HIGH 68

The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01191 Published 2023-01-20 Fixed in 9.7.5 CWE-79

Vulnerabilities

Filters

WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Scripting (XSS)

WordPress Quick Event Manager Plugin <= 9.6.4 is vulnerable to Cross Site Scripting (XSS)

WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-site scripting in Quick Event Manager WordPress Plugin