6.1
Medium
CVE-2023-4250 The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in…
Description
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EventPrime 3.2 | earliest → < 3.2.0 | 3.2.0 |
Other CVEs of EventPrime
The 8 CVEs of EventPrime →
CVE-2026-118523
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
5.3
Medium
CVE-2024-4665
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing…
6.4
Medium
CVE-2023-6447
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors…
5.3
Medium
CVE-2023-4252
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an…
Not rated