Simple Event Planner Vulnerabilities

The Simple Event Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘&custom[add_seg][]’ parameter in versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for Contributor-level attackers to inject arbitrary web scripts in...

CVSS:

5.4

Affected:

up to 1.5.4

Fixed in:

1.5.5

Disclosed:

Mar 23, 2022

CVE-2022-25611 on NVD →

Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].

CVSS:

4.1

Affected:

up to 1.5.4

Fixed in:

1.5.5

Disclosed:

Mar 23, 2022

CVE-2022-25612 on NVD →