Participants Database
by WordPress
CVEs (14)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-43141 | Cri | 0.64 | 9.8 | 0.01 | Aug 13, 2024 | Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2. | ||
| CVE-2020-8596 | Hig | 0.49 | 7.5 | 0.02 | Feb 11, 2020 | participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if… | ||
| CVE-2026-28189 | Hig | 0.48 | 7.4 | 0.00 | Aug 13, 2026 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions. | ||
| CVE-2017-14126 | Med | 0.43 | 6.1 | 0.02 | Sep 4, 2017 | The Participants Database plugin before 1.7.5.10 for WordPress has XSS. | ||
| CVE-2025-58008 | Med | 0.42 | 6.5 | 0.00 | Sep 22, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3. | ||
| CVE-2023-31235 | Med | 0.35 | 5.4 | 0.00 | Nov 9, 2023 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions. | ||
| CVE-2023-48751 | Med | 0.28 | 4.3 | 0.00 | Dec 19, 2023 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through… | ||
| CVE-2022-47612 | Med | 0.28 | 4.3 | 0.00 | Feb 28, 2023 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update. | ||
| CVE-2014-3961 | 0.03 | — | 0.06 | Jun 4, 2014 | SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/. | |||
| CVE-2026-13596 | Cri | 0.00 | 9.1 | 0.00 | Aug 1, 2026 | The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. | ||
| CVE-2026-11354 | Med | 0.00 | 5.3 | 0.00 | Jul 24, 2026 | The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and… | ||
| CVE-2026-59555 | Cri | 0.00 | 10.0 | 0.00 | Jul 23, 2026 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. | ||
| CVE-2026-59525 | Cri | 0.00 | 9.3 | 0.00 | Jul 23, 2026 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | ||
| CVE-2026-27423 | Med | 0.00 | 4.3 | 0.00 | Jul 23, 2026 | Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. |
- risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
- risk 0.49cvss 7.5epss 0.02
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if…
- risk 0.48cvss 7.4epss 0.00
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
- risk 0.43cvss 6.1epss 0.02
The Participants Database plugin before 1.7.5.10 for WordPress has XSS.
- risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.
- risk 0.35cvss 5.4epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through…
- risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.
- CVE-2014-3961Jun 4, 2014risk 0.03cvss —epss 0.06
SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/.
- risk 0.00cvss 9.1epss 0.00
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
- risk 0.00cvss 5.3epss 0.00
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and…
- risk 0.00cvss 10.0epss 0.00
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
- risk 0.00cvss 4.3epss 0.00
Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.