Event post vulnerabilities

The Event post plugin (up to version 6.1.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.

The Event post plugin (up to version 6.1.1) contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization by manipulating a user-controlled key. An attacker may gain access to resources or perform actions they are not authorized to.

The Event post plugin versions up to 6.0.1 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post. This issue affects Event post: from n/a through <= 5.10.3.