Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Event Espresso - Broken Access Control (CVE-2024-6883)
The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.
PLUGIN
Event Espresso
CVE-2024-6883
Risk Score
Threat Entry
Updated 2026-06-17
Event Espresso - Cross-Site Scripting (XSS) (CVE-2020-26153)
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
PLUGIN
Event Espresso
CVE-2020-26153
Risk Score
Threat Entry
Updated 2026-06-17
Event Espresso - Cross-Site Scripting (XSS) (CVE-2017-1002026)
Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
PLUGIN
Event Espresso
CVE-2017-1002026
Risk Score