The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Link | Resource |
---|---|
https://plugins.trac.wordpress.org/changeset/3150170/ | Patch |
https://wordpress.org/plugins/the-events-calendar/#developers | Release Notes |
https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f847d8-323f-47f9-ba10-df8173ff3018?source=cve | Third Party Advisory |
Configurations
History
04 Oct 2024, 19:08
Type | Values Removed | Values Added |
---|---|---|
First Time |
Stellarwp the Events Calendar
Stellarwp |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
CPE | cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:* | |
References | () https://plugins.trac.wordpress.org/changeset/3150170/ - Patch | |
References | () https://wordpress.org/plugins/the-events-calendar/#developers - Release Notes | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f847d8-323f-47f9-ba10-df8173ff3018?source=cve - Third Party Advisory |
30 Sep 2024, 12:46
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
27 Sep 2024, 09:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-09-27 09:15
Updated : 2024-10-04 19:08
NVD link : CVE-2024-6931
Mitre link : CVE-2024-6931
CVE.ORG link : CVE-2024-6931
JSON object : View
Products Affected
stellarwp
- the_events_calendar
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')