Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

23 records

Vendor: davidfcarr Clear all filters
TI-2025-30604 CVE-2025-48278 · GHSA-v398-g2r2-2f7r

WordPress RSVPMarker plugin <= 11.5.6 - SQL Injection Vulnerability

Priority LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.5.6.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00345 Published 2025-05-19 No fix listed CWE-89
TI-2025-22715 CVE-2025-31552 · GHSA-v7cj-mpqj-pgwf

WordPress RSVPMarker plugin <= 11.6.7 - SQL Injection vulnerability

Priority MEDIUM 47

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.6.7.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00532 Published 2025-04-01 No fix listed CWE-89
TI-2025-17298 CVE-2025-23531 · GHSA-vv37-655f-x6r8

WordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-roles allows Reflected XSS.This issue affects RSVPMaker Volun…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00293 Published 2025-01-27 No fix listed CWE-79
TI-2024-33960 CVE-2024-50531 · GHSA-fqg9-xpjx-879w

WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerability

Priority MEDIUM 49

Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: f…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00511 Published 2024-11-04 No fix listed CWE-434
TI-2022-01634 CVE-2022-1768 · GHSA-q33g-8g5w-2m7c

RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection

Priority MEDIUM 63

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.1286 Published 2022-06-13 No fix listed CWE-89
TI-2022-01378 CVE-2022-1505 · GHSA-6h3g-g32r-8ff5

RSVPMaker <= 9.2.6 - Unauthenticated SQL Injection

Priority MEDIUM 53

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01904 Published 2022-05-10 No fix listed CWE-89
TI-2022-01328 CVE-2022-1453 · GHSA-r8cv-3fj5-m22g

RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection

Priority MEDIUM 59

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06922 Published 2022-05-10 No fix listed CWE-89
TI-2021-15944 CVE-2021-38337 · GHSA-m4ch-hx25-qfhf

RSVPMaker Excel <= 1.1 Reflected Cross-Site Scripting

Priority LOW 29

The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to i…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00895 Published 2021-09-10 No fix listed CWE-79
TI-2021-06663 CVE-2021-24371 · GHSA-hjpv-ppp8-7v6j

RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF

Priority LOW 16

The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.01012 Published 2021-08-02 Fixed in 8.7.3 CWE-918