WordPress Plugin Vulnerabilities

Event Espresso Core < 4.10.7.p - Reflected Cross-Site Scripting (XSS)

Description

The admin_pages/messages/templates/ee_msg_admin_overview.template.php file of the plugin did not escape user input before outputting back in an attribute in the page, leading to a reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
event-espresso-core-reg
Fixed in 4.10.7.p

References

CVE
CVE-2020-26153
URL
https://labs.nettitude.com/blog/cve-2020-26153-event-espresso-core-cross-site-scripting/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Nettitude
Verified
Yes
WPVDB ID
923e6ddc-163b-48b0-96e9-ee9180d2f856

Timeline

Publicly Published
2021-06-25 (about 4 years ago)
Added
2021-07-13 (about 4 years ago)
Last Updated
2021-08-10 (about 4 years ago)

Other

Published
Title
Published
2025-09-22
Title
WP Frontend Admin < 1.22.8 - Contributor+ Stored XSS
Published
2026-01-08
Title
Lesson Plan Book <= 1.3 - Reflected Cross-Site Scripting
Published
2024-11-04
Title
Shortcodes Blocks Creator Ultimate < 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-09-12
Title
WordPress Affiliates Plugin — SliceWP Affiliates < 1.1.21 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
WordPress 3.3.2 Cross-Site Scripting (XSS)