by Kastro
Paper/Archive/CVE-2024-4180

CVE-2024-4180

Unknown The Events Calendar — The Events Calendar < 6.4.0.1 - Reflected XSS

EPSS 2%public exploitCVSS 9.1
critical.is priorityof 100
54
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 81.5.815 × 2016.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.

Affected

ProductAffectedFixed inSource
The Events Calendar< 6.4.0.16.4.0.1CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/b2a92316-e404-4a5e-8426-f88df6e87550