Brightvesseldev
Monthly
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Broken access control in Quick Event Manager WordPress plugin (≤9.17) allows unauthenticated remote attackers to perform unauthorized write operations against event management functions, achieving high integrity impact with no authentication required. CWE-862 (Missing Authorization) indicates the plugin omits capability checks on one or more endpoints or AJAX handlers before executing privileged actions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.