CVE-2023-6046: EventON < 2.2 - Admin+ Stored HTML Injection
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfilteredhtml capability is disallowed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6046?
CVE-2023-6046 is considered a high severity vulnerability due to its potential for Stored HTML Injection attacks.
How do I fix CVE-2023-6046?
To fix CVE-2023-6046, update the EventON WordPress plugin to version 2.2 or later.
Who is affected by CVE-2023-6046?
CVE-2023-6046 affects users of the EventON WordPress plugin prior to version 2.2, particularly those with high privilege access.
What type of attacks can be conducted using CVE-2023-6046?
CVE-2023-6046 can enable high privilege users to perform Stored HTML Injection attacks.
Is CVE-2023-6046 related to user permissions in WordPress?
Yes, CVE-2023-6046 exploits improper sanitization and escaping of settings, affecting users with admin-level privileges.