CVE-2025-24560

WordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerability

Published Jan 31, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Reflected XSS.This issue affects Awesome Event Booking: from n/a through <= 2.7.1.

Analysis

Technical impact

The flaw is a reflected cross‑site scripting vulnerability in the Awesome Event Booking WordPress plugin, classified as CWE-79. It permits an attacker to inject arbitrary client‑side scripts into the HTML output that the site delivers. When a victim follows a carefully crafted URL or submits manipulated data that is not properly sanitized, the malicious script is echoed back to the browser, enabling potential cookie theft, session hijacking, page defacement, or redirection to phishing sites.

Affected Systems

All WordPress sites running the AwesomeTOGI Awesome Event Booking plugin up to and including version 2.7.1 are impacted. The vulnerability resides solely within the plugin code and does not affect core WordPress or other plugins.

Risk and Exploitability

The CVSS score of 7.1 reflects a high‑severity risk, yet the EPSS value of less than 1% indicates a very low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires active user interaction—visiting a malicious link or submitting crafted input—so the attack surface is limited to individuals who can access the vulnerable plugin’s reflected output paths.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AwesomeTOGI

Awesome Event Booking

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.7.1

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Awesome Event Booking plugin to the latest release (post‑2.7.1) where the reflected XSS issue is fixed.
If an immediate upgrade is not feasible, locate the plugin code paths that output unescaped data and apply proper sanitization or escaping, such as wrapping dynamic content with WordPress functions like wp_kses() or esc_html().
Implement ongoing web‑application monitoring to detect suspicious URLs or unexpected script injections, and ensure the site is served over HTTPS to reduce the likelihood of Man‑in‑the‑Middle attacks that could facilitate XSS injection.

Generated by OpenCVE AI on May 1, 2026 at 17:55 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-3768	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesome TOGI Awesome Event Booking allows Reflected XSS. This issue affects Awesome Event Booking: from n/a through 2.7.1.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.266% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/awesome-event-booking/vulnerability/wordpress-awesome-event-booking-plugin-2-7-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesome TOGI Awesome Event Booking allows Reflected XSS. This issue affects Awesome Event Booking: from n/a through 2.7.1.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Reflected XSS.This issue affects Awesome Event Booking: from n/a through <= 2.7.1.
References	https://patchstack.com/database/wordpress/plugin/awesome-event-booking/vulnerability/wordpress-awesome-event-booking-plugin-2-7-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/awesome-event-booking/vulnerability/wordpress-awesome-event-booking-plugin-2-7-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Jul 11, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00035}`	epss `{'score': 0.00045}`

Feb 10, 2025 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 31, 2025 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesome TOGI Awesome Event Booking allows Reflected XSS. This issue affects Awesome Event Booking: from n/a through 2.7.1.
Title		WordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/awesome-event-booking/vulnerability/wordpress-awesome-event-booking-plugin-2-7-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`