Vulnerabilities and security researches foreventprime-event-calendar-management eventprime-event-calendar-management

Direction: ascending

Jun 07, 2024

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-5238

CVE, Research URL: CVE-2023-5238
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 31, 2023
Research Description: The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-4250

CVE, Research URL: CVE-2023-4250
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 31, 2023
Research Description: The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-33326

CVE, Research URL: CVE-2023-33326
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: May 28, 2023
Research Description: Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-45637

CVE, Research URL: CVE-2023-45637
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 25, 2023
Research Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 versions.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-1125

CVE, Research URL: CVE-2024-1125
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 09, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-4251

CVE, Research URL: CVE-2023-4251
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 31, 2023
Research Description: The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-35884

CVE, Research URL: CVE-2023-35884
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Jun 20, 2023
Research Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-1126

CVE, Research URL: CVE-2024-1126
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 13, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_attendees_email_by_event_id() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to to retrieve the attendees list for any event.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-33321

CVE, Research URL: CVE-2023-33321
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: May 17, 2024
Research Description: Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-5519

CVE, Research URL: CVE-2023-5519
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 31, 2023
Research Description: The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-4252

CVE, Research URL: CVE-2023-4252
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Nov 27, 2023
Research Description: The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2023-6447

CVE, Research URL: CVE-2023-6447
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Jan 23, 2024
Research Description: The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-24832

CVE, Research URL: CVE-2024-24832
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 23, 2024
Research Description: Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-1127

CVE, Research URL: CVE-2024-1127
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 13, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the booking_export_all() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all event booking which can contain PII.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-1320

CVE, Research URL: CVE-2024-1320
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 09, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_status' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-31275

CVE, Research URL: CVE-2024-31275
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Jun 10, 2024
Research Description: Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-1124

CVE, Research URL: CVE-2024-1124
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 09, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-1123

CVE, Research URL: CVE-2024-1123
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 09, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-29776

CVE, Research URL: CVE-2024-29776
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 27, 2024
Research Description: Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
Affected versions: Min -, max -.
Status: vulnerable

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-1321

CVE, Research URL: CVE-2024-1321
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 13, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free.
Affected versions: Min -, max -.
Status: vulnerable

Aug 13, 2024

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-43223

CVE, Research URL: CVE-2024-43223
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Nov 01, 2024
Research Description: Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.0.3.2.
Affected versions: Min -, max -.
Status: vulnerable

Sep 11, 2024

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-8369

CVE, Research URL: CVE-2024-8369
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Sep 10, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view private or password-protected events.
Affected versions: Min -, max -.
Status: vulnerable

Oct 03, 2024

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-47648

CVE, Research URL: CVE-2024-47648
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 11, 2024
Research Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in EventPrime Events EventPrime.This issue affects EventPrime: from n/a through 4.0.4.5.
Affected versions: Min -, max -.
Status: vulnerable

Oct 25, 2024

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-9865

CVE, Research URL: CVE-2024-9865
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 24, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the transaction log for a booking.
Affected versions: Min -, max -.
Status: vulnerable

Dec 18, 2024

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-12024

CVE, Research URL: CVE-2024-12024
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Dec 17, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em_ticket_individual_data parameters in all versions up to, and including, 4.0.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page. Note: this vulnerability requires the "Guest Submissions" setting to be enabled. It is disabled by default.
Affected versions: Min -, max -.
Status: vulnerable

Mar 08, 2025

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-13526

CVE, Research URL: CVE-2024-13526
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Mar 07, 2025
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.
Affected versions: Min -, max -.
Status: vulnerable

May 07, 2025

EventPrime – Events Calendar, Bookings and Tickets # CVE-2024-9864

CVE, Research URL: CVE-2024-9864
Home page URL: Security reports for EventPrime – Events Calendar, Bookings and Tickets
Application: EventPrime – Events Calendar, Bookings and Tickets
Date: Oct 24, 2024
Research Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when front-end users can submit new events with tickets.
Affected versions: Min -, max -.
Status: vulnerable