Lucene search

MitreCVE-2013-1407

HistoryMay 13, 2014 - 2:55 p.m.

CVE-2013-1407

2014-05-1314:55:08

CWE-79

mitre

web.nvd.nist.gov

cve-2013-1407

cross-site scripting

xss

wordpress

events manager

events manager pro plugin

remote code injection

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

60.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.

Affected configurations

Nvd

Node

netweblogicevents_managerRange≤5.3.4---wordpress

netweblogicevents_managerMatch5.3---wordpress

netweblogicevents_managerMatch5.3.1---wordpress

netweblogicevents_managerMatch5.3.2---wordpress

netweblogicevents_managerMatch5.3.2.1---wordpress

netweblogicevents_managerMatch5.3.3---wordpress

Node

netweblogicevents_manager_proRange≤2.2.7---wordpress

netweblogicevents_manager_proMatch2.2---wordpress

netweblogicevents_manager_proMatch2.2.1---wordpress

netweblogicevents_manager_proMatch2.2.2---wordpress

netweblogicevents_manager_proMatch2.2.3---wordpress

netweblogicevents_manager_proMatch2.2.4---wordpress

netweblogicevents_manager_proMatch2.2.5---wordpress

netweblogicevents_manager_proMatch2.2.6---wordpress

netweblogicevents_manager_proMatch2.2.8---wordpress

VendorProductVersionCPE
netweblogicevents_manager*cpe:2.3:a:netweblogic:events_manager:*:-:-:*:-:wordpress:*:*
netweblogicevents_manager5.3cpe:2.3:a:netweblogic:events_manager:5.3:-:-:*:-:wordpress:*:*
netweblogicevents_manager5.3.1cpe:2.3:a:netweblogic:events_manager:5.3.1:-:-:*:-:wordpress:*:*
netweblogicevents_manager5.3.2cpe:2.3:a:netweblogic:events_manager:5.3.2:-:-:*:-:wordpress:*:*
netweblogicevents_manager5.3.2.1cpe:2.3:a:netweblogic:events_manager:5.3.2.1:-:-:*:-:wordpress:*:*
netweblogicevents_manager5.3.3cpe:2.3:a:netweblogic:events_manager:5.3.3:-:-:*:-:wordpress:*:*
netweblogicevents_manager_pro*cpe:2.3:a:netweblogic:events_manager_pro:*:-:-:*:-:wordpress:*:*
netweblogicevents_manager_pro2.2cpe:2.3:a:netweblogic:events_manager_pro:2.2:-:-:*:-:wordpress:*:*
netweblogicevents_manager_pro2.2.1cpe:2.3:a:netweblogic:events_manager_pro:2.2.1:-:-:*:-:wordpress:*:*
netweblogicevents_manager_pro2.2.2cpe:2.3:a:netweblogic:events_manager_pro:2.2.2:-:-:*:-:wordpress:*:*

Vendor	Product	Version	CPE
netweblogic	events_manager	*	cpe:2.3:a:netweblogic:events_manager::-:-::-:wordpress::
netweblogic	events_manager	5.3	cpe:2.3:a:netweblogic:events_manager:5.3:-:-::-:wordpress::*
netweblogic	events_manager	5.3.1	cpe:2.3:a:netweblogic:events_manager:5.3.1:-:-::-:wordpress::*
netweblogic	events_manager	5.3.2	cpe:2.3:a:netweblogic:events_manager:5.3.2:-:-::-:wordpress::*
netweblogic	events_manager	5.3.2.1	cpe:2.3:a:netweblogic:events_manager:5.3.2.1:-:-::-:wordpress::*
netweblogic	events_manager	5.3.3	cpe:2.3:a:netweblogic:events_manager:5.3.3:-:-::-:wordpress::*
netweblogic	events_manager_pro	*	cpe:2.3:a:netweblogic:events_manager_pro::-:-::-:wordpress::
netweblogic	events_manager_pro	2.2	cpe:2.3:a:netweblogic:events_manager_pro:2.2:-:-::-:wordpress::*
netweblogic	events_manager_pro	2.2.1	cpe:2.3:a:netweblogic:events_manager_pro:2.2.1:-:-::-:wordpress::*
netweblogic	events_manager_pro	2.2.2	cpe:2.3:a:netweblogic:events_manager_pro:2.2.2:-:-::-:wordpress::*