CVE-2024-0614

MEDIUM

Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-0614 has a selected CVSS score of 4.4 (medium).

Description

The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 13, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Events Manager – Calendar, Bookings, Tickets, and more!

Browse netweblogic / Events Manager – Calendar, Bookings, Tickets, and more!

Default status: unaffected

CVE ListThrough 6.4.6.4affected

References

4