Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: EventON 4.5.5 Clear all filters
TI-2024-00210 CVE-2024-0235 · GHSA-w32c-7vqv-h5gw

EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

Priority MEDIUM 57

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.37957 Published 2024-01-16 Fixed in 4.5.5, 2.2.7 CWE-862
TI-2024-00209 CVE-2024-0233 · GHSA-23pw-5m4p-mjgm

EventON (Free < 2.2.8, Premium < 4.5.5) - Reflected XSS

Priority LOW 27

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00366 Published 2024-01-16 Fixed in 4.5.5, 2.2.7 CWE-116
TI-2023-05532 CVE-2023-6005 · GHSA-cf62-62c9-rpwv

EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting

Priority LOW 22

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Script…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0043 Published 2024-01-16 Fixed in 4.5.5, 2.2.7 CWE-116
TI-2024-00211 CVE-2024-0236 · GHSA-7cv2-662c-vm87

EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password Disclosure

Priority LOW 24

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00453 Published 2024-01-16 Fixed in 4.5.5, 2.2.7 CWE-862