PT-2014-2474 · WordPress · Events Manager Pro+1

Published 2014-05-13 · Updated 2014-05-20 · CVE-2013-1407

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Events Manager plugin versions prior to 5.3.5 Events Manager Pro plugin versions prior to 2.2.9

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the scope parameter to "index.php", user name, dbem phone, user email, or booking comment parameter to an event with registration enabled, and the wpnonce parameter to "wp-admin/edit.php".

Recommendations For Events Manager plugin versions prior to 5.3.5, update to version 5.3.5 or later. For Events Manager Pro plugin versions prior to 2.2.9, update to version 2.2.9 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-1407

Affected Products

Events Manager

Events Manager Pro

References · 5

• 🔥 https://htbridge.com/advisory/HTB23139 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.html · Exploit
• http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1407 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1407 · Note