Skip to content
Sign in
Not rated

CVE-2021-24943 The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the…

Description

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.

Affected products and versions

Product Affected versions Fixed in
Registrations for the Events Calendar – Event Registration Plugin 2.7 earliest → < 2.7.6 2.7.6

Other CVEs of Registrations for the Events Calendar – Event Registration Plugin

The 3 CVEs of Registrations for the Events Calendar – Event Registration Plugin →
CVE-2021-25083 The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before… Not rated CVE-2021-24876 The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before… Not rated
Track this CVE