Stored Cross-Site Scripting Vulnerability in WP Event Manager Plugin for WordPress
CVE-2023-4423

4.8MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Vendor
CVE Published:
27 September 2023

Summary

The WP Event Manager plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping within the admin settings. This flaw allows authenticated attackers with admin-level permissions to inject arbitrary scripts into pages, which are then executed when users access those pages. This vulnerability primarily affects multi-site installations and sites where unfiltered_html has been disabled, posing a significant risk to the security and integrity of the affected systems.

Affected Version(s)

WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce * <= 3.1.37.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://github.com/Jacky-Y/vuls/blob/main/vul5.md
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JackYu
.