WordPress EventON Calendar 3.0.5 Cross Site Scripting

Exploit Title: Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting Date: 27.11.2020 Exploit Author: b3kc4t Mustafa GUNDOGDU Vendor Homepage: https://www.myeventon.com/ Version: 3.0.5 Tested on: Ubuntu 18.04 CVE : 2020-29395 Description Link:...

CVE-2020-29395

The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field...

CVE-2020-29395

The CVE-2020-29395 entry applies to the WordPress EventON Calendar plugin, affecting version 3.0.5 and earlier. The vulnerability is a reflected XSS via the addons/?q= search field, allowing arbitrary script execution in the context of the affected site. The available connected documents confirm ...

CVE-2020-29395

The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field...