CVE-2023-6005: EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6005?
CVE-2023-6005 is rated as a high severity vulnerability due to its potential for stored Cross-Site Scripting attacks.
How do I fix CVE-2023-6005?
To fix CVE-2023-6005, update the EventON WordPress plugin to version 4.5.5 or later, or version 2.2.7 or later.
Who is affected by CVE-2023-6005?
CVE-2023-6005 affects users of the EventON WordPress plugin versions prior to 4.5.5 and 2.2.7.
What types of attacks does CVE-2023-6005 allow?
CVE-2023-6005 allows high privilege users, such as admins, to execute stored Cross-Site Scripting attacks.
Does CVE-2023-6005 affect all website users?
CVE-2023-6005 primarily affects high privilege users who can manipulate settings without proper sanitization.