Vulnerabilities > Liquidweb
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2025-01-30 | CVE-2024-13457 | Authorization Bypass Through User-Controlled Key vulnerability in Liquidweb Event Tickets The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. | 5.3 |
| 2023-11-23 | CVE-2023-47668 | Unspecified vulnerability in Liquidweb Restrict Content Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions. | 7.5 |
| 2023-07-17 | CVE-2023-3182 | Unspecified vulnerability in Liquidweb Restrict Content The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | 6.1 |
| 2023-03-28 | CVE-2022-45825 | Unspecified vulnerability in Liquidweb Wpcomplete Unauth. | 6.1 |
| 2023-02-13 | CVE-2022-4759 | Unspecified vulnerability in Liquidweb Gigpress The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | 5.4 |
| 2019-09-08 | CVE-2019-16120 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Liquidweb Event Tickets CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature. | 8.8 |