Lucene search

WPScanCVE-2021-24724

HistorySep 13, 2021 - 6:15 p.m.

CVE-2021-24724

2021-09-1318:15:18

CWE-79

WPScan

web.nvd.nist.gov

cve-2021-24724

timetable

event schedule

motopress

wordpress

xss

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

26.9%

JSON

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

Affected configurations

Nvd

Vulners

Node

motopresstimetable_and_event_scheduleRange<2.3.19wordpress

VendorProductVersionCPE
motopresstimetable_and_event_schedule*cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
motopress	timetable_and_event_schedule	*	cpe:2.3:a:motopress:timetable_and_event_schedule::::::wordpress::*

CNA Affected

[
  {
    "product": "Timetable and Event Schedule by MotoPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.3.19",
        "status": "affected",
        "version": "2.3.19",
        "versionType": "custom"
      }
    ]
  }
]

References

plugins.trac.wordpress.org/changeset/2573479/

wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb

www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

26.9%

JSON

Related for CVE-2021-24724