Skip to content
OpenAdvisories

Vendor

awordpresslife

14 known vulnerabilities.

Products

Event Monster – Manager & Ticket Booking 2 Formula 2 Event Monster – Event Manager, Ticket Booking & Registration 1 Album Gallery 1 Coming Soon Maintenance Mode 1 Grid Gallery for Images 1 Blog Filter Post Filtering 1 Modal Popup Box 1 Photo Gallery for Images 1 Portfolio Filter Gallery 1 Responsive Slideshow 1 Neom Blog 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-8608

    Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action

    The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_a…

    awordpresslife Event Monster – Event Manager, Ticket Booking & Registration Web / CMS
  • Medium 5.3
    CVE-2024-11396 Public exploit Scanner template

    Event monster <= 1.4.3 - Information Exposure Via Visitors List Export

    The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-…

    awordpresslife Event Monster – Manager & Ticket Booking Web / CMS
  • Medium 6.4
    CVE-2024-6262

    Portfolio Gallery – Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

    The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PFG' shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supp…

    awordpresslife Portfolio Filter Gallery Web / CMS
  • Medium 6.1
    CVE-2024-5613

    Formula <= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action

    The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output …

    awordpresslife Formula Web / CMS
  • Medium 6.1
    CVE-2024-5638

    Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins

    The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and…

    awordpresslife Formula Web / CMS
  • Medium 5.3
    CVE-2024-1475

    Coming Soon Maintenance Mode <= 1.0.5 - Information Exposure

    The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content thus bypas…

    awordpresslife Coming Soon Maintenance Mode Web / CMS
  • Medium 6.4
    CVE-2023-5291

    Blog Filter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it poss…

    awordpresslife Blog Filter Post Filtering Web / CMS