Stored Cross-Site Scripting in Event Registration Calendar Plugin by vcita for WordPress

CVE-2024-11870

What is CVE-2024-11870?

The Event Registration Calendar by vcita plugin for WordPress contains a vulnerability that allows authenticated attackers—specifically those with contributor-level access and higher—to exploit stored Cross-Site Scripting (XSS) through the use of the plugin's shortcodes. The vulnerability arises from insufficient input sanitization and output escaping for user-supplied attributes, potentially enabling the injection of arbitrary web scripts. This malicious script execution occurs whenever a user accesses an affected page, leading to unauthorized actions, data exposure, or user impersonation.

References