CVE-2024-6883

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-68845.4The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before out CVE-2024-68858.1The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to ins CVE-2024-688610.0Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Ser CVE-2024-68874.8The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, whic CVE-2024-68884.8The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic CVE-2024-68894.8The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic CVE-2024-68908.8Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user CVE-2024-68918.8Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.CVE-2024-68926.1Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.CVE-2024-68937.5The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticat CVE-2024-68945.4The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insuffic CVE-2024-68956.1Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session t