event list project vulnerabilities

Products

• event list 3

Latest event list project CVEs

Newest publication first

1. CVE-2022-0418 Event List < 0.8.8 - Admin+ Stored Cross-Site Scripting

   Published 2022-05-02

   Medium·CVSS 4.8 EPSS 0.60%

   The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks against other admin even when the unfiltered_html is disallowed

2. CVE-2017-12068 Event List <= 0.7.9 - Unauthenticated Cross-Site Scripting

   Published 2017-08-01

   Medium·CVSS 6.1 EPSS 0.78%

   The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.

3. CVE-2017-9429 Event List < 0.7.9 - Authenticated (Admin+) SQL Injection

   Published 2017-06-13

   High·CVSS 8.8 EPSS 2.7% Public exploit

   SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.