CVE-2024-7982 - Registrations for The Events Calendar < 2.12.4

Back Back to CVE browser

CRITICAL

Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS

Published Nov 8, 2024

9.6

CRITICAL

CVSS 3.1

EPSS 0.69%

Description

The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

Affected products

Vendor n/a Product Registrations for the Events Calendar Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.12.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Registrations for the Events Calendar

unaffected

Version	Status	Constraints
0	affected	<2.12.4

Vendor Roundupwp Product Registrations for the Events Calendar Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.12.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Roundupwp

Registrations for the Events Calendar

unaffected

Version	Status	Constraints
0	affected	<2.12.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48815
Advisory
https://wpscan.com/vulnerability/d79e1e9c-980d-4974-bfbd-d87d6e28d9a6/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48815		Advisory
https://wpscan.com/vulnerability/d79e1e9c-980d-4974-bfbd-d87d6e28d9a6/		exploitvdb-entrytechnical-descriptionThird Party Advisory