Veille CVE

Recherche « EventPrime »

6 CVE

Critique 0 Élevée 6 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « EventPrime » ✕
  1. CVE-2026-13441 7.2 Élevée

    metagauss EventPrime – Events Calendar, Bookings and Tickets

    The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.

  2. CVE-2026-56053 8.8 Élevée

    EventPrime

    Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

  3. CVE-2026-42687 8.1 Élevée

    EventPrime

    Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

  4. CVE-2026-42686 7.1 Élevée

    EventPrime

    Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.

  5. CVE-2026-39518 7.1 Élevée

    EventPrime

    Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

  6. CVE-2026-42669 7.5 Élevée

    EventPrime

    Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.