CVE-2021-24724 Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting

2021-09-1317:56:38

CWE-79

WPScan

www.cve.org

cve-2021-24724

timetable and event schedule

motopress

stored cross-site scripting

wordpress

xss

low privilege users

EPSS

0.001

Percentile

26.9%

JSON

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

CNA Affected

[
  {
    "product": "Timetable and Event Schedule by MotoPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.3.19",
        "status": "affected",
        "version": "2.3.19",
        "versionType": "custom"
      }
    ]
  }
]