PT-2021-16227 · Motopress · Timetable/Event Schedule

Martin Vierula · Published 2021-09-13 · Updated 2021-09-23 · CVE-2021-24724

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Timetable and Event Schedule by MotoPress WordPress plugin versions prior to 2.3.19

Description The issue allows low privilege users, such as authors, to perform XSS attacks against frontend and backend users when viewing related events. This is due to the plugin not sanitizing some of its parameters.

Recommendations For versions prior to 2.3.19, update to version 2.3.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for low-privilege users until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24724

Affected Products

Timetable/Event Schedule

References · 7

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235 · Exploit
• 🔥 https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb · Exploit
• https://osv.dev/vulnerability/CVE-2021-24724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24724 · Security Note
• https://t.me/cibsecurity/28752 · Telegram Post
• https://t.me/cvenotify/20792 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/2573479 · Note