EventPrime – Events Calendar, Bookings, Tickets & AI

Уязвимости

• CVE-2026-24378без авторизации≤ 4.2.8.0

  WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability

  Критич. 9.8

• CVE-2024-31275без авторизации≤ 3.3.4

  WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerability

  Критич. 9.8

• CVE-2026-56053подписчик+≤ 4.3.4.1

  WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability

  Высокий 8.8

• CVE-2024-43223нужен вход≤ 4.0.3.2

  WordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2026-42687без авторизации≤ 4.3.2.1

  WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

  Высокий 8.1

• CVE-2026-42669без авторизации≤ 4.3.2.0

  WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability

  Высокий 7.5

• CVE-2025-69358без авторизации≤ 4.2.6.0

  WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability

  Высокий 7.5

• CVE-2026-25312без авторизации≤ 4.2.8.3

  WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability

  Высокий 7.5

• CVE-2024-24832без авторизации≤ 3.3.9

  WordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerability

  Высокий 7.5

• CVE-2026-13441без авторизации≤ 4.3.4.2

  EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

  Высокий 7.2

• CVE-2026-42686подписчик+≤ 4.3.2.1

  WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-39518подписчик+≤ 4.3.0.0

  WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability

  Высокий 7.1

• CVE-2024-1123подписчик+≤ 3.4.2

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite

  Средний 6.5

• CVE-2024-12024без авторизации≤ 4.0.7.3

  EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name

  Средний 6.1

• CVE-2024-9865без авторизации · нужен клик≤ 4.0.4.7

  EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log

  Средний 6.1

• CVE-2024-47648без авторизации · нужен клик≤ 4.0.4.5

  WordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerability

  Средний 6.1

• CVE-2024-1320без авторизации≤ 3.4.3

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting

  Средний 6.1

• CVE-2023-45637без авторизации · нужен клик≤ 3.1.5

  WordPress EventPrime Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2023-35884без авторизации · нужен клик≤ 3.0.5

  WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2023-33326без авторизации · нужен клик≤ 2.8.6

  WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2024-1125подписчик+≤ 3.4.3

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

  Средний 5.4

• CVE-2026-25389без авторизации≤ 4.2.8.3

  WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability

  Средний 5.3

• CVE-2026-1657без авторизации≤ 4.2.8.4

  EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

  Средний 5.3

• CVE-2026-24380без авторизации≤ 4.2.8.0

  WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2025-14507без авторизации≤ 4.2.7.0

  EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API

  Средний 5.3

• CVE-2024-8369без авторизации≤ 4.0.4.3

  EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure

  Средний 5.3

• CVE-2023-33321без авторизации≤ 2.8.6

  WordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure

  Средний 5.3

• CVE-2024-1321без авторизации≤ 3.4.2

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass

  Средний 5.3

• CVE-2024-29776высокие права≤ 3.3.9

  WordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2026-1655подписчик+≤ 4.2.8.4

  EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter

  Средний 4.3

• CVE-2025-63006нужен вход≤ 4.2.4.1

  WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability

  Средний 4.3

• CVE-2025-63007нужен вход≤ 4.2.4.1

  WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerability

  Средний 4.3

• CVE-2025-12498подписчик+≤ 4.2.0.0

  EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation

  Средний 4.3

• CVE-2024-13526подписчик+≤ 4.0.7.3

  EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export

  Средний 4.3

• CVE-2024-1127подписчик+≤ 3.4.1

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export

  Средний 4.3

• CVE-2024-1126подписчик+≤ 3.4.2

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval

  Средний 4.3

• CVE-2024-1124подписчик+≤ 3.4.3

  EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending

  Средний 4.3