CVE-2023-4251

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	EventPrime	< 3.2.0

References

https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19Exploit, Third Party Advisory
https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19Exploit, Third Party Advisory

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-42525.3The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase booki CVE-2023-425207.5Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Se CVE-2023-425217.5Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Se CVE-2023-425227.5Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecu CVE-2023-425237.5Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15 CVE-2023-425247.5Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security CVE-2023-425257.5Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security CVE-2023-425267.5Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Clien CVE-2023-425275.5Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose s CVE-2023-425287.8Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute CVE-2023-425297.8Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code.CVE-2023-42534.8The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such