PT-2023-6550 · WordPress · Quick Event Manager Wordpress Plugin

Joshua Martinelle · Publicado 2023-01-16 · Atualizado 2023-01-26 · CVE-2023-23491

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Quick Event Manager WordPress Plugin version prior to 9.7.5

Description The issue is related to a reflected cross-site scripting vulnerability. It affects the category parameter of the qem ajax calendar action. This vulnerability can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack, potentially due to insufficient protection of the webpage structure.

Recommendations For versions prior to 9.7.5, update to version 9.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the qem ajax calendar action or avoiding the use of the category parameter in this action until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-07312

CVE-2023-23491

Produtos afetados

Quick Event Manager Wordpress Plugin

Referências · 4

• 🔥 https://tenable.com/security/research/tra-2023-3 · Exploit
• https://bdu.fstec.ru/vul/2023-07312 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-23491 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-23491 · Aviso do Fabricante