Metagauss
Page 2 of 2 — Metagauss CVEs from a corpus of 110, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2951 | Medium | 4.3 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.3.0.0. |
CVE-2024-24832 | High | 8.2 | 2024-03-23 | Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9. |
CVE-2024-29113 | High | 7.1 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This iss… |
CVE-2024-1321 | Medium | 5.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This i… |
CVE-2024-1127 | Medium | 4.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-1126 | Medium | 4.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-1320 | Medium | 6.5 | 2024-03-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_status' parameter in… |
CVE-2024-1125 | Medium | 5.4 | 2024-03-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the… |
CVE-2024-1124 | Medium | 4.3 | 2024-03-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on th… |
CVE-2024-1123 | Medium | 6.5 | 2024-03-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec… |
CVE-2023-51509 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic – Custom Registration Forms… |
CVE-2023-6447 | Medium | 5.3 | 2024-01-22 | The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected… |
CVE-2022-36352 | Medium | 6.3 | 2024-01-08 | Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profi… |
CVE-2023-50846 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration… |
CVE-2023-47645 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login… |
CVE-2023-4252 | Medium | 5.3 | 2023-11-27 | The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment. |
CVE-2023-47644 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid… |
CVE-2023-5519 | Medium | 4.3 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwan… |
CVE-2023-5238 | Medium | 6.1 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on th… |
CVE-2023-4251 | Medium | 4.3 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwan… |
CVE-2023-4250 | Medium | 6.1 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross… |
CVE-2023-45637 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 versions. |
CVE-2023-3404 | Medium | 4.9 | 2023-08-31 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to th… |
CVE-2023-3714 | High | 7.5 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versio… |
CVE-2023-3713 | High | 8.8 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_conn… |
CVE-2023-3403 | Medium | 5.4 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in ve… |
CVE-2022-38062 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions. |
CVE-2023-35884 | High | 7.1 | 2023-06-20 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions. |
CVE-2022-36345 | Medium | 4.3 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions. |
CVE-2023-33326 | High | 7.1 | 2023-05-28 | Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions. |
CVE-2023-2548 | Medium | 6.6 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plu… |
CVE-2023-2499 | Critical | 9.8 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verifi… |
CVE-2023-0889 | Medium | 6.5 | 2023-04-17 | Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be up… |
CVE-2023-0940 | High | 8.8 | 2023-03-20 | The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows… |
CVE-2023-25991 | Medium | 5.4 | 2023-03-13 | Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions. |
CVE-2021-25059 | Medium | 4.3 | 2022-11-28 | The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which ma… |
CVE-2022-41791 | Medium | 6.8 | 2022-11-17 | Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. |
CVE-2022-3578 | Medium | 6.1 | 2022-11-14 | The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2022-0420 | High | 7.2 | 2022-03-07 | The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automatio… |
CVE-2021-24648 | Medium | 6.1 | 2022-02-01 | The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leadin… |
CVE-2022-0233 | Medium | 6.4 | 2022-01-18 | The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping… |
CVE-2022-0232 | Medium | 4.8 | 2022-01-18 | The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text par… |
CVE-2021-24862 | High | 7.2 | 2022-01-10 | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when dup… |
CVE-2021-4073 | Critical | 9.8 | 2021-12-14 | The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid us… |
CVE-2021-24703 | Medium | 5.7 | 2021-11-23 | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated… |
CVE-2020-8436 | Medium | 6.1 | 2020-03-12 | XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter. |
CVE-2020-8435 | High | 8.1 | 2020-03-12 | An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter. |
CVE-2020-9458 | High | 8.8 | 2020-03-06 | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submit… |
CVE-2020-9457 | High | 8.8 | 2020-03-06 | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and ch… |
CVE-2020-9456 | High | 8.8 | 2020-03-06 | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their… |
CVE-2020-9455 | Medium | 4.3 | 2020-03-06 | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of th… |
CVE-2020-9454 | High | 8.8 | 2020-03-06 | A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator… |
CVE-2019-15873 | High | 8.8 | 2019-09-03 | The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with th… |