CVE-2024-7982

Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS

The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

Affected

Registrations for the Events Calendar

CVSS v3.1 CNA

9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.73% chance of exploitation in the next 30 days, 53rd percentile

Published

2024-11-08

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d79e1e9c-980d-4974-bfbd-d87d6e28d9a6/

Security advisories

• https://wpscan.com/vulnerability/d79e1e9c-980d-4974-bfbd-d87d6e28d9a6

References

• CVE Record
• NVD entry