Eventprime (Unknown) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-05-15. Vendor: Unknown.

CVEs of Eventprime

• CVE-2024-4665 - CVSS 6.4 (medium), 2025-05-15: The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other…
• CVE-2023-6447 - CVSS 5.3 (medium), 2024-01-22: The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password…
• CVE-2023-4252 - CVSS 5.3 (medium), 2023-11-27: The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
• CVE-2023-5519 - CVSS 4.3 (medium), 2023-10-31: The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create…
• CVE-2023-5238 - CVSS 6.1 (medium), 2023-10-31: The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on…
• CVE-2023-4251 - CVSS 4.3 (medium), 2023-10-31: The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create…
• CVE-2023-4250 - CVSS 6.1 (medium), 2023-10-31: The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected…