Headline

CVE-2022-25612: WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities - Patchstack

Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].

2 years ago

CVE

Open in Source

#xss #vulnerability #web

simple-event-planner

Software

Simple Event Planner

Vulnerable Versions

<= 1.5.4

Fixed in version

1.5.5

CVE

CVE-2022-25612

References

Credits

Classification

Cross Site Scripting (XSS)

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Disclosure Date

2022-03-23

CVSS 3.0 score

Requires author or higher role user authentication.

Are your websites subject to this vulnerability?

Details

Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities discovered by Ex.Mi (Patchstack) in WordPress Simple Event Planner plugin (versions <= 1.5.4).

Solution

Update the WordPress Simple Event Planner plugin to the latest available version (at least 1.5.5).

Found a vulnerability that puts your sites at risk?

Found a vulnerability? Help us secure the web and join our community of ethical hackers.

Are you the developer of this software? Hire our researchers for a thorough security audit.