The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Fri, 04 Oct 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Stellarwp
Stellarwp the Events Calendar |
|
CPEs | cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Stellarwp
Stellarwp the Events Calendar |
Fri, 27 Sep 2024 16:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Theeventscalendar
Theeventscalendar the Events Calendar |
|
CPEs | cpe:2.3:a:theeventscalendar:the_events_calendar:*:*:*:*:*:*:*:* | |
Vendors & Products |
Theeventscalendar
Theeventscalendar the Events Calendar |
|
Metrics |
ssvc
|
Fri, 27 Sep 2024 09:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting | |
Weaknesses | CWE-79 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-27T08:46:24.891Z
Updated: 2024-09-27T16:01:02.162Z
Reserved: 2024-07-19T22:28:08.196Z
Link: CVE-2024-6931
Vulnrichment
Updated: 2024-09-27T16:00:56.452Z
NVD
Status : Analyzed
Published: 2024-09-27T09:15:04.130
Modified: 2024-10-04T19:08:35.457
Link: CVE-2024-6931
Redhat
No data.