WP Event Manager < 3.1.38 - Admin+ Stored XSS

2023-09-2700:00:00

wpscan.com

wp event manager

admin settings

xss vulnerability

multi-site installations

unfiltered_html

5.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

JSON

Description The plugin does not adequately sanitize and escape input in the admin settings. This flaw could lead to stored cross-site scripting attacks, specifically in multi-site installations or where unfiltered_html has been disabled.

CPENameOperatorVersion
eq3.1.38

CPE	Name	Operator	Version
		eq	3.1.38

References

www.wordfence.com/threat-intel/vulnerabilities/id/dd9d22b0-a84a-4bf2-b8b4-89bae2970f29