Timetable and Event Schedule by MotoPress < 2.3.19 – Author+ Stored Cross-Site Scripting | CVE 2021-24724 | Plugin Vulnerabilities

Description

The plugin does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

Proof of Concept

Create an event with the following payload in the description of a timeslot: <img src onerror=alert(/XSS/)>

The XSS will be executed in the frontend and backend when viewing the related event

Affects Plugins

Fixed in 2.3.19

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2573479/

URL

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Martin Vierula of Trustwave

Verified

Yes

WPVDB ID

c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb

Timeline

Publicly Published

2021-08-23 (about 4 years ago)

Added

2021-08-23 (about 4 years ago)

Last Updated

2022-04-24 (about 3 years ago)

Other

Published

Title

Published

2024-05-01

Title

Sydney Toolbox < 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2022-05-26

Title

Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS

Published

2024-04-18

Title

Newspaper < 12.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta

Published

2019-03-25

Title

PWA for WP <= 1.0.8 - XSS

Published

2025-08-15

Title

Uji Countdown <= 2.3.3 - Reflected Cross-Site Scripting