Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
2 selected

2 records

Vendor: Wp Fevents Book Project Component: Wp Fevents Book Clear all filters
TI-2023-01065 CVE-2023-1126 · GHSA-93f7-6pj6-f9gr

WP FEvents Book <= 0.46 - Subscriber+ Stored XSS

Priority LOW 25

The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00441 Published 2023-04-24 No fix listed
TI-2023-01067 CVE-2023-1129 · GHSA-c29f-jm2c-8vv7

WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR

Priority MEDIUM 62

The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of oth…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00555 Published 2023-04-24 No fix listed