PT-2024-26948 · WordPress · Easyevent

M3Hd22 + 2 · Published 2024-05-07 · Updated 2025-05-09 · CVE-2024-3628

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EasyEvent WordPress plugin versions 1.0.0 and earlier

Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not sanitizing and escaping some of its settings.

Recommendations For EasyEvent WordPress plugin versions 1.0.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-3628

Affected Products

Easyevent

References · 7

• 🔥 https://wpscan.com/vulnerability/171af8eb-ceeb-403a-abc2-969d9535a4c9 · Exploit
• https://osv.dev/vulnerability/CVE-2024-3628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3628 · Security Note
• https://t.me/cvenotify/121584 · Telegram Post
• https://twitter.com/CVEnew/status/1787888374415577455 · Twitter Post
• https://t.me/purp_sec/441 · Telegram Post
• https://t.me/cvenotify/79362 · Telegram Post