Wpevently
Monthly
Unauthenticated integrity compromise in the WpEvently WordPress plugin (versions 5.3.3 and earlier) by MagePeople allows remote attackers to alter application data over the network without privileges or user interaction. The vendor-supplied description is a Patchstack placeholder ('Other Vulnerability Type') and does not identify the specific endpoint or function, but the CVSS vector indicates high integrity impact with no confidentiality or availability impact. No public exploit identified at time of analysis.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WpEvently WordPress plugin (mage-eventpress) affecting versions up to and including 5.1.4, allowing attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs. The vulnerability stems from improper neutralization of user input during web page generation (CWE-79), enabling attackers to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. No CVSS score or EPSS data is currently available, but the Patchstack reporting and EUVD tracking indicate this is a documented and confirmed vulnerability requiring prompt patching.
Cross-site scripting (CWE-80) in the WpEvently WordPress plugin from Magepeople Inc. affects all versions through 5.7.9 and lets an attacker place script-related HTML that executes in a victim's browser once the injected content is rendered. The supplied vector scores 5.3 with PR:N, but real-world exploitation still hinges on a victim loading the affected page (our assessment uses UI:R rather than UI:N), so impact is bounded to visitor-side script execution such as content or session manipulation rather than server compromise; the vulnerable parameter and whether the payload is stored or reflected are not described in the sources. Only a Patchstack database entry is available, no public exploit code has been identified at time of analysis, and the issue is prioritized as this-month rather than immediate action.
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WpEvently versions prior to 5.1.9 inadvertently expose sensitive information in transmitted data, allowing unauthenticated remote attackers to retrieve embedded secrets without user interaction. This information disclosure vulnerability affects the mage-eventpress plugin and could enable attackers to obtain credentials or other confidential data. No patch is currently available.
Unauthenticated integrity compromise in the WpEvently WordPress plugin (versions 5.3.3 and earlier) by MagePeople allows remote attackers to alter application data over the network without privileges or user interaction. The vendor-supplied description is a Patchstack placeholder ('Other Vulnerability Type') and does not identify the specific endpoint or function, but the CVSS vector indicates high integrity impact with no confidentiality or availability impact. No public exploit identified at time of analysis.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WpEvently WordPress plugin (mage-eventpress) affecting versions up to and including 5.1.4, allowing attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs. The vulnerability stems from improper neutralization of user input during web page generation (CWE-79), enabling attackers to steal session cookies, perform unauthorized actions, or redirect users to malicious sites. No CVSS score or EPSS data is currently available, but the Patchstack reporting and EUVD tracking indicate this is a documented and confirmed vulnerability requiring prompt patching.
Cross-site scripting (CWE-80) in the WpEvently WordPress plugin from Magepeople Inc. affects all versions through 5.7.9 and lets an attacker place script-related HTML that executes in a victim's browser once the injected content is rendered. The supplied vector scores 5.3 with PR:N, but real-world exploitation still hinges on a victim loading the affected page (our assessment uses UI:R rather than UI:N), so impact is bounded to visitor-side script execution such as content or session manipulation rather than server compromise; the vulnerable parameter and whether the payload is stored or reflected are not described in the sources. Only a Patchstack database entry is available, no public exploit code has been identified at time of analysis, and the issue is prioritized as this-month rather than immediate action.
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WpEvently versions prior to 5.1.9 inadvertently expose sensitive information in transmitted data, allowing unauthenticated remote attackers to retrieve embedded secrets without user interaction. This information disclosure vulnerability affects the mage-eventpress plugin and could enable attackers to obtain credentials or other confidential data. No patch is currently available.