Fooevents Vulnerabilities

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue affects FooEvents for WooCommerce: from n/a through <= 1.20.4.

Affected:

up to 1.20.4

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2025-69045 on NVD →

The FooEvents for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.20.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level a...

CVSS:

6.5

Affected:

up to 1.20.4

Fixed in:

1.20.5

Disclosed:

Dec 30, 2025

CVE-2025-69045 on NVD →

[en] The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilitie...

Affected:

up to 1.19.21

Fixed in:

1.19.21

Disclosed:

Jun 15, 2024

CVE-2024-6000 on NVD →

The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or...

CVSS:

7.1

Affected:

up to 1.19.20

Fixed in:

1.19.21

Disclosed:

Jun 14, 2024

CVE-2024-6000 on NVD →