Description (CNA)
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Events Made Easy | affected 2.2.24 before 2.2.24 |
CWE
CWE-79
References
- https://wpscan.com/vulnerability/a1fe0783-7a88-4d75-967f-cef970b73752
- https://plugins.trac.wordpress.org/changeset/2607749/
ADP enrichment
No English description supplied.