PT-2023-6550 · WordPress · Quick Event Manager Wordpress Plugin

Joshua Martinelle · Published 2023-01-16 · Updated 2023-01-26 · CVE-2023-23491

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Quick Event Manager WordPress Plugin version prior to 9.7.5

Description The issue is related to a reflected cross-site scripting vulnerability. It affects the category parameter of the qem ajax calendar action. This vulnerability can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack, potentially due to insufficient protection of the webpage structure.

Recommendations For versions prior to 9.7.5, update to version 9.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the qem ajax calendar action or avoiding the use of the category parameter in this action until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07312

CVE-2023-23491

Affected Products

Quick Event Manager Wordpress Plugin

References · 4

• 🔥 https://tenable.com/security/research/tra-2023-3 · Exploit
• https://bdu.fstec.ru/vul/2023-07312 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23491 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23491 · Vendor Advisory