Stored Cross-Site Scripting Vulnerability Affects EventPrime's WordPress Plugin
CVE-2024-9865

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Eventprime – Events Calendar, Bookings And Tickets
Vendor
CVE Published:
24 October 2024

Summary

The Events Calendar, Bookings and Tickets plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This flaw is present in the ‘ep_booking_attendee_fields’ fields in all versions up to and including 4.0.4.7. Due to a lack of proper input sanitization and output escaping, unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts. These scripts are executed whenever a user accesses the transaction log for a booking, posing a significant security risk to site users and their data.

Affected Version(s)

EventPrime – Events Calendar, Bookings and Tickets * <= 4.0.4.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://plugins.trac.wordpress.org/changeset/3170503/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
.