Vulnerability Details : CVE-2021-24724
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2021-24724
Probability of exploitation activity in the next 30 days: 0.06%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 25 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-24724
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST |
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
2.3
|
2.7
|
NIST |
CWE ids for CVE-2021-24724
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: contact@wpscan.com (Primary)
References for CVE-2021-24724
-
https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb
Attention Required! | CloudflareExploit;Third Party Advisory
-
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235
Exploit;Third Party Advisory
-
https://plugins.trac.wordpress.org/changeset/2573479/
Changeset 2573479 – WordPress Plugin RepositoryThird Party Advisory
Products affected by CVE-2021-24724
- cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:*