CVE-2022-1054

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10557.8A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit re CVE-2022-10565.5Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that CVE-2022-10579.8The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a S CVE-2022-10586.1Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.CVE-2022-10596.1Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-10617.5Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.CVE-2022-10624.8The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2022-10634.8The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Message CVE-2022-10648.8SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.CVE-2022-10658.8A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This is CVE-2022-10668.2Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-10676.5Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and