CVE-2022-2844

🗓️ 16 Aug 2022 18:50:29Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 43 Views🌐 WEB

A problematic vulnerability in MotoPress Timetable and Event Schedule up to 1.4.06 allows remote attackers to execute cross-site scripting via manipulated arguments in Calendar Handler component

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2022-2844	16 Aug 202222:39	–	circl
CNNVD	WordPress plugin MotoPress Timetable and Event Schedule 跨站脚本漏洞	16 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2844 MotoPress Timetable and Event Schedule Calendar cross site scripting	16 Aug 202218:50	–	cvelist
EUVD	EUVD-2022-35078	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2844	16 Aug 202219:15	–	nvd
Prion	Cross site scripting	16 Aug 202219:15	–	prion
Positive Technologies	PT-2022-19030 · Motopress · Motopress Timetable/Event Schedule	16 Aug 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2844	22 May 202522:41	–	redhatcve

NVD

Vulners

Node

motopress timetable_and_event_scheduleRange≤1.4.06wordpress

[
  {
    "product": "Timetable and Event Schedule",
    "vendor": "MotoPress",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.06"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
Subject	request body	/wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2	XSS via manipulation of Subject/Location/Description in the affected endpoint	CWE-79
Location	request body	/wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2	XSS via manipulation of Subject/Location/Description in the affected endpoint	CWE-79
Description	request body	/wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2	XSS via manipulation of Subject/Location/Description in the affected endpoint	CWE-79

21 Nov 2024 07:01Current

4.8Medium risk

Vulners AI Score4.8

CVSS 3.13.5 - 6.1

EPSS0.00224

CWE-79