Join our followers
Cross-site Scripting (XSS) Vulnerability WP Events Calendar
| Advisory ID: | HTB23037 |
| Product: | WP Events Calendar |
| Vendor: | Luke Howell |
| Vulnerable Versions: | 6.7.11 and probably prior |
| Tested Version: | 6.7.11 |
| Advisory Publication: | August 10, 2011 [without technical details] |
| Vendor Notification: | August 10, 2011 |
| Public Disclosure: | August 26, 2011 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79] |
| Risk Level: | Low |
 | |
| CVSSv2 Base Score: | 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered vulnerability in WP Events Calendar, which can be exploited to perform cross-site scripting attacks. | |
| Solution: | |
| Upgrade to version 6.7.12a. | |
References: | |
| [1] High-Tech Bridge Advisory HTB23037 - https://www.immuniweb.com/advisory/HTB23037 - Cross-site Scripting (XSS) Vulnerability WP Events Calendar [2] WP Events Calendar - wp-eventscalendar.com- Events-Calendar is a versatile replacement for the original calendar included with WordPress adding many useful functions to keep track of your events. [3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
HTB23036: Cross-site Scripting (XSS) Vulnerability in Fast Secure Contact Form
HTB23035: Cross-site Scripting (XSS) Vulnerabilities in WP-Stats-Dashboard
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
