PT-2024-15400 · WordPress · Eventon

Erwan Lr · Published 2024-01-16 · Updated 2024-01-19 · CVE-2024-0233

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EventON WordPress plugin versions prior to 4.5.5 EventON WordPress plugin versions prior to 2.2.7

Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before outputting it back in pages. This leads to a Reflected Cross-Site Scripting issue, which could be exploited against high-privilege users such as administrators.

Recommendations For versions prior to 4.5.5, update to version 4.5.5 or later. For versions prior to 2.2.7, update to version 2.2.7 or later. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2024-0233

Affected Products

Eventon

References · 5

• 🔥 https://wpscan.com/vulnerability/04a708a0-b6f3-47d1-aac9-0bb17f57c61e · Exploit
• https://osv.dev/vulnerability/CVE-2024-0233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0233 · Security Note
• https://twitter.com/CVEnew/status/1747293129982832812 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1747313600673309140 · Twitter Post