CVE-2024-4752: EventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitle
The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4752?
CVE-2024-4752 has a high severity rating due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-4752?
To fix CVE-2024-4752, update the EventON WordPress plugin to version 2.2.15 or later.
Who is affected by CVE-2024-4752?
CVE-2024-4752 affects installations of the EventON WordPress plugin prior to version 2.2.15.
What type of attacks can be executed due to CVE-2024-4752?
CVE-2024-4752 allows high privilege users to perform Stored Cross-Site Scripting attacks.
Does CVE-2024-4752 affect multisite WordPress setups?
Yes, CVE-2024-4752 can affect multisite WordPress setups where the unfiltered_html capability is disallowed.