The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts.
References
Configurations
History
21 Nov 2024, 08:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=cve - Third Party Advisory |
07 Oct 2024, 12:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Stellarwp the Events Calendar
Stellarwp |
|
| CPE | cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:* |
12 Feb 2024, 20:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=cve - Third Party Advisory | |
| CPE | cpe:2.3:a:tri:the_events_calendar:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| First Time |
Tri
Tri the Events Calendar |
|
| CWE | NVD-CWE-noinfo |
05 Feb 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-05 22:15
Updated : 2024-11-21 08:44
NVD link : CVE-2023-6557
Mitre link : CVE-2023-6557
CVE.ORG link : CVE-2023-6557
JSON object : View
Products Affected
stellarwp
- the_events_calendar
CWE