Skip to content
Sign in
5.9 Medium

CVE-2024-4752 The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high…

Description

The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected products and versions

Product Affected versions Fixed in
EventON 2.2 earliest → < 2.2.15 2.2.15
eventon 2.2 earliest → < 2.2.15 2.2.15

Other CVEs of EventON

The 13 CVEs of EventON →
CVE-2024-6910 The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high… 4.8 Medium CVE-2023-7200 The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the… 6.1 Medium CVE-2024-0238 The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an… 6.1 Medium CVE-2024-0235 The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX… 5.3 Medium
Track this CVE