ByteOS Network

NVD Vulnerability Details :

CVE-2021-24724

Analyzed

Source-contact@wpscan.com

Published At-13 Sep, 2021 | 18:15

Updated At-23 Sep, 2021 | 15:25

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

motopress>>timetable_and_event_schedule>>Versions before 2.3.19(exclusive)

cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	contact@wpscan.com

References

Hyperlink	Source	Resource
https://plugins.trac.wordpress.org/changeset/2573479/	contact@wpscan.com	Third Party Advisory
https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb	contact@wpscan.com	Exploit Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235	contact@wpscan.com	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History