Plugin icon

Participants Database

participants-database
Plugin closed

Vulnerabilities:

19

Last Updated:

July 31, 2026

Active Installs:

7000

Published
Title
Fixed in
CVSS
Published
2026-12-01
Title
Participants Database <= 2.7.8.5 - Unauthenticated Blind SSRF via Image Field URL
Fixed in
No known fix
CVSS
4.7 (medium)
Published
2026-12-01
Title
Participants Database <= 2.7.8.5 - Admin+ SQLi via Manage Fields Group Reorder
Fixed in
No known fix
CVSS
4.1 (medium)
Published
2026-12-01
Title
Participants Database <= 2.7.8.5 - Unauthenticated Sensitive Data Disclosure via Arbitrary Search Field
Fixed in
No known fix
CVSS
6.5 (medium)
Published
2026-12-01
Title
Participants Database <= 2.7.8.5 - Unauthenticated Arbitrary Record Update via Signup Form
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2026-10-21
Title
Participants Database <= 2.7.8.5 - Unauthenticated SQL Injection
Fixed in
No known fix
CVSS
7.5 (high)
Published
2026-10-21
Title
Participants Database <= 2.7.8.5 - Unauthenticated PHP Object Injection
Fixed in
No known fix
CVSS
8.1 (high)
Published
2026-10-20
Title
Participants Database <= 2.7.8.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Fixed in
No known fix
CVSS
2.7 (low)
Published
2026-08-13
Title
Participants Database < 2.7.8.5 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 2.7.8.5
CVSS
9.1 (critical)
Published
2026-07-23
Title
Participants Database < 2.7.8.4 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Fixed in
Fixed in 2.7.8.4
CVSS
5.3 (medium)
Published
2026-07-22
Title
Participants Database < 2.7.8.4 - Unauthenticated SQL Injection
Fixed in
Fixed in 2.7.8.4
CVSS
7.5 (high)
Published
2026-07-22
Title
Participants Database < 2.7.8.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 2.7.8.4
CVSS
9.1 (critical)
Published
2026-07-22
Title
Participants Database < 2.7.8.5 - Missing Authorization
Fixed in
Fixed in 2.7.8.5
CVSS
4.3 (medium)
Published
2026-07-20
Title
Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search
Fixed in
Fixed in 2.7.8.4
CVSS
8.6 (high)
Published
2025-09-22
Title
Participants Database <= 2.7.7 - Contributor+ Stored XSS
Fixed in
Fixed in 2.7.7
CVSS
5.9 (medium)
Published
2024-08-07
Title
Participants Database < 2.5.9.3 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 2.5.9.3
CVSS
8.1 (high)
Published
2023-11-27
Title
Participants Database < 2.5.6 - Missing Authorization
Fixed in
Fixed in 2.5.6
CVSS
5.3 (medium)
Published
2020-02-10
Title
Participants Database < 1.9.5.6 - Authenticated Time Based SQL Injection
Fixed in
Fixed in 1.9.5.6
CVSS
7.5 (high)
Published
2017-09-06
Title
Participants Database <= 1.7.5.9 - Cross-Site Scripting
Fixed in
Fixed in 1.7.5.10
CVSS
6.1 (medium)
Published
2014-08-01
Title
Participants Database < 1.5.4.9 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.5.4.9
CVSS
10.0 (critical)