CVE-2024-13802

Summary

CVE-2024-13802: The Bandsintown Events plugin for WordPress, up to version 1.3.1, is vulnerable to Stored Cross-Site Scripting (XSS). Attackers with contributor-level access or higher can exploit this vulnerability by injecting malicious scripts into the 'bandsintown_events' shortcode. These scripts will be executed whenever a user visits an affected page, leading to potential security risks such as data theft or unauthorized account access. The root cause of this issue is insufficient input sanitization and output escaping on user-supplied attributes. WordPress users are advised to update to the latest plugin version or remove the plugin altogether to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.