Описание
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.4.8.3 (исключая)
cpe:2.3:a:tickera:tickera:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 94%
0.12126
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
github
около 4 лет назад
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
EPSS
Процентиль: 94%
0.12126
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79