WordPress Plugin Vulnerabilities

RSVPMarker < 10.6.7 - Unauthenticated Stored XSS

Description

The plugin does not validate and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
rsvpmaker
Fixed in 10.6.7

References

CVE
CVE-2023-27616
URL
https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-4-cross-site-scripting-xss-vulnerability-2

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Muhammad Arsalan Diponegoro - tripoloski
Verified
No
WPVDB ID
5cdddfd3-861c-42b8-8e87-5c69cefd5581

Timeline

Publicly Published
2023-08-17 (about 2 years ago)
Added
2023-09-27 (about 2 years ago)
Last Updated
2023-09-27 (about 2 years ago)

Other

Published
Title
Published
2024-08-28
Title
The Plus Addons for Elementor Page Builder Lite < 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2024-08-29
Title
Elementor Addon Elements < 1.13.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2024-02-12
Title
Bold Page Builder < 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
Published
2026-04-07
Title
Gravity Forms < 2.9.31 - Reflected Cross-Site Scripting via 'form_ids' Parameter
Published
2024-04-18
Title
Save as PDF < 3.2.0 - Admin+ Stored XSS