WordPress Plugin Vulnerabilities

Events Manager < 5.9.6 - Authenticated Stored Cross-Site Scripting (XSS)

Description

The Events Manager WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
events-manager
Fixed in 5.9.6

References

CVE
CVE-2019-16523
URL
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-03_WordPress_Plugin_Events_Manager

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Tobias Fink (SBA Research)
Verified
No
WPVDB ID
c994ce7f-b772-492d-a4c8-c037b1a08290

Timeline

Publicly Published
2019-10-16 (about 6 years ago)
Added
2019-10-16 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2021-08-10
Title
Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2024-06-13
Title
Gutenberg Blocks by Kadence Blocks – Page Builder Features < 3.2.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter
Published
2023-05-11
Title
WP Category Post List Widget <= 2.0.3 - Contributor+ Stored XSS
Published
2024-02-19
Title
ProfilePress < 4.15.0 - Unauthenticated Stored XSS
Published
2024-03-25
Title
Podlove Web Player < 5.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting