EventON < 2.2.17 – Admin+ Stored XSS | CVE 2024-6910 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Proof of Concept

1. Access: /wp-admin/admin.php?page=eventon-lang
2. Click on "Other".
3. On "List" field put XSS payload and Save Changes: " accesskey=x onclick="alert(window.origin)
4. By typing ALT + SHIFT + X the XSS will be triggered.
5. By clicking on "List" field the XSS will be triggered.

Affects Plugins

Fixed in 2.2.17

References

CVE

YouTube Video

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Wesley "dk4trin" Santos

Submitter

Wesley "dk4trin" Santos

Submitter twitter

Verified

Yes

WPVDB ID

468373c6-7e47-489a-92c1-75025c543fd5

Timeline

Publicly Published

2024-08-19 (about 1 year ago)

Added

2024-08-19 (about 1 year ago)

Last Updated

2024-08-19 (about 1 year ago)

Other

Published

Title

Published

2025-07-04

Title

Easy Elements Hider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2017-05-16

Title

WP Booking System < 1.4 - Authenticated Stored Cross-Site Scripting (XSS)

Published

2025-09-03

Title

Orbit Fox by ThemeIsle < 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-12-05

Title

Unlock Addons for Elementor <= 2.2.2 - Contributor+ Stored XSS

Published

2025-01-06

Title

RightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting