CVE-2024-6910: EventON < 2.2.17 - Admin+ Stored XSS
Published Sep 9, 2024
·Updated
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed.
Affected Software
1 affected component
Myeventon Eventon Wordpress<2.2.17
Event History
Sep 9, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-6910?
CVE-2024-6910 has a medium severity rating due to the potential for Cross-Site Scripting attacks.
2
How do I fix CVE-2024-6910?
To fix CVE-2024-6910, update the EventON WordPress plugin to version 2.2.17 or later.
3
Who is affected by CVE-2024-6910?
CVE-2024-6910 affects high privilege users, such as administrators, of the EventON WordPress plugin.
4
What type of attack is possible with CVE-2024-6910?
CVE-2024-6910 allows for Cross-Site Scripting (XSS) attacks due to inadequate sanitization of settings.
5
Which versions of EventON are vulnerable to CVE-2024-6910?
Versions of the EventON WordPress plugin prior to 2.2.17 are vulnerable to CVE-2024-6910.