CVE Vulnerability

CVE-2021-24724

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb Exploit Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235 Exploit Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2573479/ Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:*
Information

Published : 2021-09-13 06:15

Updated : 2021-09-23 03:25

NVD link : CVE-2021-24724

Mitre link : CVE-2021-24724

Products Affected
No products.
CWE
CWE-79