WP Event Manager < 3.1.42 - Editor+ Stored XSS

2023-12-0800:00:00

wpscan.com

wp event manager

vulnerability

stored xss

editor

security

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks

CPENameOperatorVersion
eq3.1.42

CPE	Name	Operator	Version
		eq	3.1.42

References

patchstack.com/database/vulnerability/wp-event-manager/wordpress-wp-event-manager-plugin-3-1-39-cross-site-scripting-xss-vulnerability-2