eventespresso vulnerabilities

Products

• event espresso 3
• Event Espresso – Event Registration & Ticketing Sales 2
• event espresso 4 decaf 1
• event espresso lite 1

Latest eventespresso CVEs

Newest publication first

1. CVE-2024-6883 Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification

   Published 2024-08-21

   Medium·CVSS 4.3 EPSS 0.28%

   The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46...

2. CVE-2021-4404 Event Espresso 4 Decaf <= 4.10.11 - Cross-Site Request Forgery Bypass

   Published 2023-07-01

   Medium·CVSS 4.3 EPSS 0.39%

   The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing or incorrect nonce validation on the ajaxHandler() function. This makes it possible for unauthenticated attackers to op in...

3. CVE-2020-26153 Event Espresso Core <= 4.10.6.p - Reflected Cross-Site Scripting

   Published 2021-07-13

   Medium·CVSS 6.1 EPSS 4.4%

   A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTM...

4. CVE-2017-14760 Event Espresso Free/Lite <= 3.1.37.12.L - Unauthenticated SQL Injection

   Published 2017-09-27

   Critical·CVSS 9.8 EPSS 1.5%

   SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.

5. CVE-2017-1002026 Event Expresso Free <= 3.1.37.11.L - Authenticated SQL Injection

   Published 2017-09-14

   High·CVSS 8.8 EPSS 1.7%

   Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.