Filtered by vendor Theeventscalendar Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-25025 1 Theeventscalendar 1 Eventcalendar 2022-12-09 4.3 Medium
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
CVE-2021-25024 1 Theeventscalendar 1 Eventcalendar 2022-01-24 6.1 Medium
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
CVE-2015-5485 1 Theeventscalendar 1 Eventbrite Tickets 2015-08-19 N/A
Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php.