6.1
Medium
CVE-2023-5238 The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the…
Description
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EventPrime 3.2 | earliest → < 3.2.0 | 3.2.0 |
Other CVEs of EventPrime
The 8 CVEs of EventPrime →
CVE-2026-118523
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
5.3
Medium
CVE-2024-4665
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing…
6.4
Medium
CVE-2023-6447
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors…
5.3
Medium
CVE-2023-4252
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an…
Not rated