CVEvulnerability
CVE-2021-24724
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-09-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
Affected configurations
• motopress timetable and event schedule (< 2.3.19)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://plugins.trac.wordpress.org/changeset/2573479/ Third Party Advisory
- https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb Exploit, Third Party Advisory
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235 Exploit, Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2573479/ Third Party Advisory
- https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb Exploit, Third Party Advisory
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235 Exploit, Third Party Advisory