Stored Cross-Site Scripting Vulnerability Affects EventPrime's WordPress Plugin
CVE-2024-9865
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 24 October 2024
What is CVE-2024-9865?
The Events Calendar, Bookings and Tickets plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This flaw is present in the ‘ep_booking_attendee_fields’ fields in all versions up to and including 4.0.4.7. Due to a lack of proper input sanitization and output escaping, unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts. These scripts are executed whenever a user accesses the transaction log for a booking, posing a significant security risk to site users and their data.
Affected Version(s)
EventPrime – Events Calendar, Bookings and Tickets * <= 4.0.4.7