CVE-2022-25611: WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[addseg][].
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-25611?
CVE-2022-25611 is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability found in the Simple Event Planner plugin version 1.5.4 and below.
How does CVE-2022-25611 impact users?
CVE-2022-25611 allows attackers with contributor or higher user roles to inject malicious scripts into the plugin, potentially leading to unauthorized actions or data theft.
What is the severity of CVE-2022-25611?
CVE-2022-25611 has a severity score of 5.4, which is considered medium.
How can I fix CVE-2022-25611?
To fix CVE-2022-25611, update the Simple Event Planner plugin to version 1.5.5 or higher, which contains a patch for the vulnerability.
More information about CVE-2022-25611
For more information about CVE-2022-25611, you can refer to the following resources: [Patchstack](https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-authenticated-stored-cross-site-scripting-xss-vulnerability) and [WordPress Plugin Directory](https://wordpress.org/plugins/simple-event-planner/#developers).