CVE-2025-14507mediumCWE-200

CVE-2025-14507: falha de média gravidade em metagauss EventPrime – Events Calendar…

EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar EventPrime – Events Calendar, Bookings and Tickets

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
metagauss · EventPrime – Events Calendar, Bookings and Tickets
CVEs relacionadas — metagauss EventPrime – Events Calendar…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1127MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event ExportEPSS 0.5%CVE-2024-1126MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List RetrievalEPSS 0.4%CVE-2026-13441HIGHEventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' ParameterEPSS 0.4%CVE-2026-1657MEDIUMEventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX EndpointEPSS 0.4%CVE-2024-12024HIGHEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type NameEPSS 0.4%CVE-2024-1123MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post OverwriteEPSS 0.4%