CVE-2021-24797: Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24797?
CVE-2021-24797 is a vulnerability in the Tickera WordPress plugin before version 3.4.8.3 that allows unauthenticated users to execute Cross-Site Scripting (XSS) attacks against admins by exploiting the improper sanitization of the Name fields in booked Events.
What is the severity of CVE-2021-24797?
CVE-2021-24797 has a severity level of medium, with a CVSS score of 6.1.
How can unauthenticated users exploit CVE-2021-24797?
Unauthenticated users can exploit CVE-2021-24797 by injecting malicious code into the Name fields of booked Events, which will be executed when viewed by admins in the Orders admin dashboard.
Is there a fix for CVE-2021-24797?
Yes, the fix for CVE-2021-24797 is to update the Tickera WordPress plugin to version 3.4.8.3 or higher.
What is Cross-Site Scripting (XSS)?
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized actions or data theft.