Headline

CVE-2022-25611: WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability - Patchstack

Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].

2 years ago

CVE

Open in Source

#xss #vulnerability #web

simple-event-planner

Software

Simple Event Planner

Vulnerable Versions

<= 1.5.4

Fixed in version

1.5.5

CVE

CVE-2022-25611

References

Credits

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Disclosure Date

2022-03-23

CVSS 3.0 score

Requires contributor or higher role user authentication.

Are your websites subject to this vulnerability?

Details

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Ngo Van Thien (Patchstack Alliance) in WordPress Simple Event Planner plugin (versions <= 1.5.4).

Solution

Update the WordPress Simple Event Planner plugin to the latest available version (at least 1.5.5).

Found a vulnerability that puts your sites at risk?

Found a vulnerability? Help us secure the web and join our community of ethical hackers.

Are you the developer of this software? Hire our researchers for a thorough security audit.