Event Post
Monthly
Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers without any credentials to bypass authorization checks and access restricted functionality or data. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with no authentication, no user interaction, and low attack complexity, making it trivially scriptable. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated network vector means vulnerable sites can be mass-scanned.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post allows DOM-Based XSS.9.11. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5.9.6 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers without any credentials to bypass authorization checks and access restricted functionality or data. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with no authentication, no user interaction, and low attack complexity, making it trivially scriptable. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated network vector means vulnerable sites can be mass-scanned.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post allows DOM-Based XSS.9.11. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5.9.6 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.