CVE-2021-24797
Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
MEDIUM 6.1EPSS 1.2%
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Affected
- Tickera – WordPress Event Ticketing
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 1.17% chance of exploitation in the next 30 days, 67th percentile
- Published
- 2021-12-27
- Updated
- 2024-08-03