WordPress Plugin Timetable and Event Schedule 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2021-16100 · WordPress · Timetable/Event Schedule

Name of the Vulnerable Software and Affected Versions: Timetable and Event Schedule WordPress plugin versions prior to 2.4.2 Timetable and Event Schedule WordPress plugin versions prior to 2.3.19 Description: The issue concerns a lack of proper access control when updating timeslots, allowing any...

WordPress 插件信息泄露漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on servers running PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. An information disclosure vulnerability exists in the...

WordPress Plugin Timetable and Event Schedule 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2021-24724

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s...

CVE-2021-24724

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s...

Design/Logic Flaw

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s...

CVE-2021-24724

CVE-2021-24724 affects the WordPress plugin “Timetable and Event Schedule by MotoPress” (versions before 2.3.19). The vulnerability is a stored XSS due to unsanitized parameters, allowing low-privilege users (e.g., authors) to execute scripts against frontend and backend users when viewing relate...

CVE-2021-24724 Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s...

WordPress Timetable and Event Schedule by MotoPress plugin <= 2.3.19 - Arbitrary User's Hashed Password/Email/Username Disclosure vulnerability

Arbitrary User's Hashed Password/Email/Username Disclosure vulnerability discovered by dc11 in WordPress Timetable and Event Schedule by MotoPress plugin versions = 2.3.19. Solution Update the WordPress Timetable and Event Schedule by MotoPress plugin to the latest available version at least 2.4....

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion

The plugin does not have proper access control when deleting a timeslot, allowing any user with the editposts capability contributor+ to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in wit...

Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure

The plugin outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts capability. Combined with the other Unauthorised Event...

WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.1 - Unauthorized Event TimeSlot Update vulnerability

Unauthorized Event TimeSlot Update vulnerability discovered by dc11 in WordPress Timetable and Event Schedule by MotoPress plugin versions = 2.4.1. Solution Update the WordPress Timetable and Event Schedule by MotoPress plugin to the latest available version at least 2.4.2...

WordPress Timetable and Event Schedule by MotoPress plugin <= 2.3.18 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Cross-Site Scripting XSS vulnerabilities discovered by Martin Vierula Trustwave in WordPress Timetable and Event Schedule by MotoPress plugin versions = 2.3.18. Solution Update the WordPress Timetable and Event Schedule by MotoPress plugin to the latest available version at least...

WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.1 - Unauthorized Event TimeSlot Deletion vulnerability

Unauthorized Event TimeSlot Deletion vulnerability discovered by dc11 in WordPress Timetable and Event Schedule by MotoPress plugin versions = 2.4.1. Solution Update the WordPress Timetable and Event Schedule by MotoPress plugin to the latest available version at least 2.4.2...

Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s Create an event with the following payload in the description of a timeslot: The XSS will be execute...

Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s PoC Create an event with the following payload in the description of a timeslot: The XSS will be...

Tokyo Olympics Leveraged in Cybercrime Attack

Just before the opening of the Tokyo Olympics, we confirmed an attack that directed users from a fake TV broadcast schedule page to browser notification spam...

Jock on air now < 5.6.3 - Authenticated Stored Cross-Site Scripting

The plugin does not properly sanitise and escape some Show parameters before outputting them in pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Vulnerable parameters: linkURL some validation is done and...

Cross-Site Request Forgery (CSRF) in emoncms/dashboard

💥 BUG csrf bug to change schedule to public 💥 STEP TO REPRODUCE 1. First login into your account and open the link http://localhost/emoncms/schedule/set.json?id=1&fields=%22public%22:true and your schedule will be change from private to public. 💥 IMPACT Any attacker can send those link to vicitm...