Quick Event Manager Vulnerabilities

The Quick Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to injec...

CVSS:

5.5

Affected:

up to 9.6.4

Fixed in:

9.6.5

Disclosed:

Feb 14, 2023

CVE-2022-46863 on NVD →

The Quick Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'yourname' parameter in versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wi...

CVSS:

7.2

Affected:

up to 9.7.4

Fixed in:

9.7.5

Disclosed:

Jan 20, 2023

CVE-2023-23979 on NVD →

The Quick Event Manager plugin for WordPress is vulnerable to authorization bypass due to missing authorization checks on various calls in the qem_messages() function in versions up to, and including, 9.7.4. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to manage and...

CVSS:

6.3

Affected:

up to 9.7.4

Fixed in:

9.7.5

Disclosed:

Jan 20, 2023

CVE-2023-23975 on NVD →

The Quick Event Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.7.4. This is due to missing nonce validation on several calls in the qem_messages() function. This makes it possible for unauthenticated attackers to manage and alter registration settings that s...

CVSS:

6.3

Affected:

up to 9.7.4

Fixed in:

9.7.5

Disclosed:

Jan 20, 2023

CVE-2023-23974 on NVD →

The Quick Event Manager WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 9.7.4 via the 'category' parameter of the 'qem_ajax_calendar' action due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVSS:

6.1

Affected:

up to 9.7.5

Fixed in:

9.7.5

Disclosed:

Jan 12, 2023

CVE-2023-23491 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 9.2.17

Fixed in:

9.2.17

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →