← Back to CVEs

CVE-2021-24724

MEDIUM

5.4

Description

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

CVE Details

CVSS v3.1 Score5.4

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published9/13/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

motopress:timetable_and_event_schedule

Weaknesses (CWE)

CWE-79

References

https://plugins.trac.wordpress.org/changeset/2573479/(contact@wpscan.com)

https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb(contact@wpscan.com)

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235(contact@wpscan.com)

https://plugins.trac.wordpress.org/changeset/2573479/(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb(af854a3a-2127-422b-91ae-364da2661108)

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.