CVE-2023-4388: EventON < 2.2 - Admin+ Stored XSS
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4388?
CVE-2023-4388 is a vulnerability in the EventON WordPress plugin before version 2.2 that allows high privilege users to perform Stored Cross-Site Scripting attacks.
How does CVE-2023-4388 work?
CVE-2023-4388 works by not sanitizing and escaping some of the plugin's settings, which allows high privilege users such as admins to insert malicious code that can be executed by other users.
What is the severity of CVE-2023-4388?
CVE-2023-4388 has a severity rating of medium with a CVSS score of 4.8.
How can I fix CVE-2023-4388?
To fix CVE-2023-4388, update your EventON WordPress plugin to version 2.2 or later, which includes the necessary sanitization and escaping of settings.
Where can I find more information about CVE-2023-4388?
You can find more information about CVE-2023-4388 at the following reference link: [CVE-2023-4388](https://wpscan.com/vulnerability/4086b62c-c527-4721-af63-7f2687c98648)