CVE-2025-66083

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection. This issue affects WpEvently: from n/a through 5.7.9.

The WpEvently plugin (versions up to 5.7.8) by Magepeople inc. contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for subscribers. Subscriber-level users can gain unauthorized access to administrative functions.

The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.

WpEvently versions up to 5.3.3 contain an unauthenticated vulnerability that could be exploited by attackers.

A Cross-Site Request Forgery (CSRF) vulnerability was found in the WpEvently plugin for WordPress up to version 4.1.2. Lack of proper protections allows an attacker to perform unauthorized actions in the context of an authenticated user.

The WordPress plugin WpEvently (up to version 5.0.4) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthorized actions within the plugin.