CVE Database /
CVE-2024-3492
CVE · Medium
CVE-2024-3492 — Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-3492
|
Events Manager – Calendar, Bookings, Tickets, and more! [events-manager] < 6.4.8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 6.4.8
|
6.4.8 |
2024-06-11 |
—
|
CVE-2024-3492
The Events Manager plugin through version 6.4.7.3 contains a stored cross-site scripting vulnerability in its event, location, and event_category shortcodes because user-supplied shortcode attributes are not properly sanitized or escaped. Authenticated users with at least contributor privileges can inject malicious scripts into pages via these shortcodes, and the scripts will execute whenever someone views the affected page. The vulnerability was fixed in version 6.4.8.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings