What is the CVSS score of CVE-2024-4665?

CVE-2024-4665 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Eventprime are affected by CVE-2024-4665?

Organizations using EventPrime WordPress should be aware of moderate risk from CVE-2024-4665 rated CVSS 6.4. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for CVE-2024-4665?

Yes, a public proof-of-concept exploit is available for CVE-2024-4665. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2024-4665?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Eventprime CVE-2024-4665

MEDIUM

2025-05-15 contact@wpscan.com

WordPress Information Disclosure Eventprime

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:42 vuln.today

PoC Detected

Nov 13, 2025 - 21:15 vuln.today

Public exploit code

CVE Published

May 15, 2025 - 20:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.

AnalysisAI

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Eventprime

View all

CVE-2023-5238 MEDIUM This Month POC

6.1 Oct 31

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the p

CVE-2023-4250 MEDIUM This Month POC

6.1 Oct 31

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in

CVE-2026-24378 CRITICAL Act Now

9.8 Mar 25

This is a PHP Object Injection vulnerability in the Metagauss EventPrime WordPress plugin (eventprime-event-calendar-man

CVE-2024-31275 CRITICAL Act Now

9.8 Jun 09

Missing Authorization vulnerability in Metagauss EventPrime.3.4. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-4252 MEDIUM This Month POC

5.3 Nov 27

The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attack

CVE-2026-56053 HIGH This Week

8.8 Jun 25

PHP Object Injection in the EventPrime event-calendar-management WordPress plugin (versions 4.3.4.1 and earlier) allows

CVE-2024-43223 HIGH This Week

8.8 Nov 01

Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Cont

CVE-2023-5519 MEDIUM This Month POC

4.3 Oct 31

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attacke

CVE-2023-4251 MEDIUM This Month POC

4.3 Oct 31

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attacke

CVE-2024-24832 HIGH This Week

8.2 Mar 23

Missing Authorization vulnerability in Metagauss EventPrime.3.9. Rated high severity (CVSS 8.2), this vulnerability is r

CVE-2026-42687 HIGH This Week

8.1 Jun 15

Unauthenticated PHP Object Injection in the EventPrime event calendar plugin for WordPress (versions <= 4.3.2.1) allows

CVE-2026-42669 HIGH This Week

7.5 Jun 02

Broken access control in the EventPrime WordPress plugin (versions up to and including 4.3.2.0) allows unauthenticated r

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2024-4665 vulnerability details – vuln.today

Back