event_list_project - MidnightBSD Security Advisories

Advisories for event_list_project

CVE-2017-12068 MEDIUM

The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
event_list_project	event_list	0.7.9

CVE-2017-9429 MEDIUM

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
event_list_project	event_list	0.7.8