CVE-2021-24876

🗓️ 29 Nov 2021 08:25:43Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 45 Views🌐 WEB

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scriptin

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2021-24876	29 Nov 202112:33	–	circl
CNNVD	WordPress 插件跨站脚本漏洞	29 Nov 202100:00	–	cnnvd
Cvelist	CVE-2021-24876 Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting	29 Nov 202108:25	–	cvelist
EUVD	EUVD-2021-11788	7 Oct 202500:30	–	euvd
Nuclei	Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting	6 Jun 202603:01	–	nuclei
NVD	CVE-2021-24876	29 Nov 202109:15	–	nvd
OSV	CVE-2021-24876	29 Nov 202109:15	–	osv
Patchstack	WordPress Registrations for the Events Calendar plugin <= 2.7.4 - Reflected Cross-Site Scripting (XSS) vulnerability	27 Oct 202100:00	–	patchstack
Prion	Cross site scripting	29 Nov 202109:15	–	prion
Positive Technologies	PT-2021-16349	29 Nov 202100:00	–	ptsecurity

NVD

Vulners

Node

roundupwp registrations_for_the_events_calendarRange<2.7.5wordpress

[
  {
    "product": "Registrations for the Events Calendar – Event Registration Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.7.5",
        "status": "affected",
        "version": "2.7.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/e77c2493-993d-418d-9629-a1f07b5a2b6f

Parameter	Position	Path	Description	CWE
v	query param	/wp-admin/admin.php?page=registrations-for-the-events-calendar&tab=registrations&v="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//	Reflected Cross-Site Scripting via unescaped v parameter.	CWE-79

21 Nov 2024 05:53Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24.3

CVSS 3.16.1

EPSS0.00246

CWE-79