Stored Cross-Site Scripting in Events Manager Plugin for WordPress

CVE-2024-0614

Summary

The Events Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in admin settings. Authenticated attackers with administrator-level permissions can exploit this vulnerability to inject arbitrary web scripts, which will execute when users access the compromised pages. This vulnerability impacts multi-site installations and those where unfiltered_html has been disabled, allowing for a significant security risk within affected environments.

References