The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Eventlist Plugin | — | Update eventlist plugin to version 2.0.5, or a newer patched version | Aug 26, 2025 | Aug 25, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub