Vulnerability · Published Nov 8, 2024 · Assigned by WPScan

CVE-2024-7982Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS

Critical 9.6

In plain English

A critical-severity cross-site scripting in Registrations for the Events Calendar from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.7%top 45.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Registrations for the Events Calendar	0 – before 2.12.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/d79e1e9c-980d-4974-bfbd-d87d6e28d9a6/ exploit, vdb-entry, technical-description