xnau vulnerabilities

Products

• Participants Database 7

Latest xnau CVEs

Newest publication first

1. CVE-2026-11354 Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter

   Published 2026-07-24

   Medium·CVSS 5.3 EPSS 0.42%

   The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and r...

2. CVE-2023-48751 WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control

   Published 2023-12-18

   High·CVSS 8.8 EPSS 0.25%

   Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5...

3. CVE-2023-31235 WordPress Participants Database Plugin <= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-09

   High·CVSS 8.8 EPSS 0.35%

   Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.

4. CVE-2022-47612 WordPress Participants Database Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-02-28

   Medium·CVSS 4.3 EPSS 0.23%

   Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.

5. CVE-2020-8596 Participants Database <= 1.9.5.5 - SQL Injection

   Published 2020-02-10

   High·CVSS 7.5 EPSS 1.6%

   participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if cert...

6. CVE-2017-14126 Participants Database <= 1.7.5.9 - Unauthorized Cross-Site Scripting

   Published 2017-09-04

   Medium·CVSS 6.1 EPSS 2.3% Public exploit

   The Participants Database plugin before 1.7.5.10 for WordPress has XSS.

7. CVE-2014-3961 Participants Database < 1.5.4.9 - SQL Injection

   Published 2014-06-04

   High·CVSS 7.5 EPSS 5.6% Public exploit

   SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.