CVE-2022-4320

MEDIUMNuclei

WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-4320 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WordPress Events Calendar Plugin

Default status: unaffected

CVE ListBefore 1.4.5affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Events Calendar <1.4.5 - Cross-Site ScriptingCVSS 6.1

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be used against both unauthenticated and authenticated users.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.

Remediation

Fixed in version 1.4.5.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscvecve2022calendareventxsswordpresswpwp-pluginwpscanmhsoftwarevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:mhsoftware:wordpress_events_calendar_plugin:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/f1244c57-d886-4a6e-8cdb-18404e8c153c https://nvd.nist.gov/vuln/detail/CVE-2022-4320

Source: ProjectDiscovery

References

2