CVE-2021-24724

Опубликовано: 13 сент. 2021

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

Ссылки

https://plugins.trac.wordpress.org/changeset/2573479/
Third Party Advisory
https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb
Exploit
Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2573479/
Third Party Advisory
https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb
Exploit
Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:*

Версия до 2.3.19 (исключая)

EPSS

Процентиль: 48%

0.00252

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-c847-r6f2-c2wj

github

больше 3 лет назад