blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2017-14760

CRITICAL 9.8 CVSS 3.0
Published
September 27, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-89
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.

Affected products and versions

  • n/a n/a — Versions not specified
  • eventespresso event_espresso_lite — Up to and including 3.1.37.12.l

References

  • www.sstrunk.com http://www.sstrunk.com/cve/wp_event-espresso-free.html Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record