Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting

2021-10-0400:00:00

Huy Nguyen

260

0.001 Low

EPSS

Percentile

21.5%

JSON

The plugin does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Add/Edit a Custom Field (/wp-admin/admin.php?page=eme-formfields) and put the following payload in the Field Name: a<script>alert(/XSS/)</script>

The XSS will be triggered when accessing some pages like Custom Field, Pending Bookings, Approved Bookings

References

plugins.trac.wordpress.org/changeset/2607749/

0.001 Low

EPSS

Percentile

21.5%

JSON

Related for WPEX-ID:A1FE0783-7A88-4D75-967F-CEF970B73752