Skip to content
OpenAdvisories

Product · bastho

Event post

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-2167

    Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This…

    bastho Event post Web / CMS
  • Medium 6.4
    CVE-2024-10186

    Event Post <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode

    The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5.9.6 due to insufficient input sanitization and output escaping on user supplied attributes. This mak…

    bastho Event post Web / CMS
  • Medium 4.3
    CVE-2024-1375

    Event post <= 5.9.10 - Cross-Site Request Forgery

    The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versions up to, and including, 5.9.10. This makes it possible for unauthenticated attackers to update pos…

    bastho Event post Web / CMS
  • Medium 4.3
    CVE-2024-1376

    Event post <= 5.9.4 - Missing Authorization

    The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subsc…

    bastho Event post Web / CMS