CVE-2021-25083: Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site Scripting
Published Jan 24, 2022
·Updated
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
Affected Software
1 affected component
Roundupwp Registrations For The Events Calendar Wordpress<=2.7.10
Remediation
Patch Available
Event History
Jan 24, 2022
CVE Published
via MITRE·08:01 AM
Data Sourced
via MITRE·08:01 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-25083?
CVE-2021-25083 has a medium severity rating due to its potential for reflected cross-site scripting attacks.
2
How do I fix CVE-2021-25083?
To fix CVE-2021-25083, update the Registrations for the Events Calendar plugin to version 2.7.10 or later.
3
What platforms are affected by CVE-2021-25083?
CVE-2021-25083 affects any WordPress site that uses the Registrations for the Events Calendar plugin versions prior to 2.7.10.
4
What type of attack is CVE-2021-25083 associated with?
CVE-2021-25083 is associated with reflected cross-site scripting (XSS) attacks.
5
Is CVE-2021-25083 easy to exploit?
Yes, CVE-2021-25083 can be easily exploited if an attacker can trick a victim into clicking a manipulated URL.