Vulnerability · Published Jan 16, 2024 · Assigned by WPScan

CVE-2024-0233EventON (Free < 2.2.8, Premium < 4.5.5) - Reflected XSS

Medium 6.1

In plain English

A medium-severity security flaw in EventON from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products (as reported)

Vendor	Product	Versions
Unknown	EventON	0 – before 4.5.5
Unknown	EventON	0 – before 2.2.7

References

https://wpscan.com/vulnerability/04a708a0-b6f3-47d1-aac9-0bb17f57c61e/ exploit, vdb-entry, technical-description