Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: bastho Clear all filters
TI-2025-01899 CVE-2025-2167 · GHSA-3chc-844q-fxqw

Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 24

The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00242 Published 2025-03-26 No fix listed CWE-79
TI-2024-10490 CVE-2024-11324 · GHSA-8xgv-qx2j-4cx2

Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scripting

Priority LOW 27

The Accounting for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.6.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00354 Published 2024-12-05 No fix listed CWE-79
TI-2024-01282 CVE-2024-1375 · GHSA-2wpm-fgjv-c368

Event post <= 5.9.10 - Cross-Site Request Forgery

Priority LOW 19

The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versions up to, and including, 5.9.10.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00191 Published 2024-07-12 No fix listed CWE-352