CVE-2023-4635: EventON <= 2.2.2 - Reflected Cross-Site Scripting
The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
CVE-2023-4635
What is the title of this vulnerability?
The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the tab parameter.
What is the severity of CVE-2023-4635?
The severity of CVE-2023-4635 is medium.
How does CVE-2023-4635 impact the affected software?
CVE-2023-4635 allows unauthenticated attackers to inject arbitrary web scripts in pages through the 'tab' parameter.
How can I fix the vulnerability in the affected software?
To fix the vulnerability, upgrade to a version of EventON plugin for WordPress that is higher than 2.2.2.