Vulnerabilities

TI-2025-18292 CVE-2025-24575 · GHSA-cmx2-533j-hg92

WordPress HelloAsso plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00383 Published 2025-01-24 No fix listed CWE-79

TI-2024-29641 CVE-2024-44052 · GHSA-pf8p-m654-4w75

WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00342 Published 2024-11-01 No fix listed CWE-862

TI-2024-07049 CVE-2024-7605 · GHSA-8584-5866-2gjv

HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update

LOW 20

The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versions up to, and including, 1.1.10.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00427 Published 2024-09-05 No fix listed CWE-862

TI-2024-24992 CVE-2024-37488 · GHSA-hx7r-48g7-4jrp

WordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.9.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00279 Published 2024-07-21 No fix listed CWE-79

TI-2024-21577 CVE-2024-32697 · GHSA-7wm5-xpr2-m85j

WordPress HelloAsso plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso: from n/a through 1.1.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0032 Published 2024-04-22 No fix listed CWE-79

Vulnerabilities

Filters

WordPress HelloAsso plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerability

WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability

HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update

WordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

WordPress HelloAsso plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability