CVE-2020-26153

MEDIUMNuclei

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-26153 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMEvent Espresso Core-Reg 4.10.7.p - Cross-Site ScriptingCVSS 6.1

Event Espresso Core-Reg 4.10.7.p is vulnerable to cross-site scripting in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php and allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.

Remediation

Upgrade to Event Espresso Core-Reg version 4.10.7.p or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscve2020cvexsswordpresswp-plugineventespressovuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:eventespresso:event_espresso:*:*:*:*:*:wordpress:*:*
https://labs.nettitude.com/blog/cve-2020-26153-event-espresso-core-cross-site-scripting/ https://github.com/eventespresso/event-espresso-core/compare/4.10.6.p...4.10.7.p https://nvd.nist.gov/vuln/detail/CVE-2020-26153 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3