Описание
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.8.31 (исключая)
cpe:2.3:a:my_tickets_project:my_tickets:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 94%
0.12126
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
github
больше 3 лет назад
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
EPSS
Процентиль: 94%
0.12126
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79