WordPress Plugin Vulnerabilities

Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)

Description

The plugin does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Proof of Concept

Affects Plugins

Plugin icon
community-events
Fixed in 1.4.8

References

CVE
CVE-2021-24496

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
iohex
Submitter
iohex
Submitter twitter
iohehe
Verified
Yes
WPVDB ID
5fd1cb7f-a036-4c5b-9557-0ffd4ef6b834

Timeline

Publicly Published
2021-07-02 (about 4 years ago)
Added
2021-07-02 (about 4 years ago)
Last Updated
2022-01-17 (about 3 years ago)

Other

Published
Title
Published
2024-12-17
Title
Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS
Published
2025-12-15
Title
Visitor Statistics (Real Time Traffic) < 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-24
Title
Live Streaming Video Player – by SRS Player <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-09-22
Title
Uncanny Toolkit for LearnDash < 3.7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-26
Title
LinkMyPosts <= 1.0 - Reflected XSS