Vulnerability Details : CVE-2021-24724
Potential exploit
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2021-24724
- cpe:2.3:a:motopress:timetable_and_event_schedule:*:*:*:*:*:wordpress:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-24724
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-24724
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST | |
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
2.3
|
2.7
|
NIST |
CWE ids for CVE-2021-24724
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: contact@wpscan.com (Primary)
References for CVE-2021-24724
-
https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb
Attention Required! | CloudflareExploit;Third Party Advisory
-
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235
Exploit;Third Party Advisory
-
https://plugins.trac.wordpress.org/changeset/2573479/
Changeset 2573479 – WordPress Plugin RepositoryThird Party Advisory
Jump to