CVE-2024-2111

CVSS 3.1 Score 7.8 of 10 (high)

Details

Published Mar 28, 2024
Updated: Jan 8, 2025

Summary

CVE-2024-2111 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Events Manager plugin for WordPress, versions up to and including 6.4.7.1. This issue stems from insufficient input sanitization and output escaping in the physical location value. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts. These scripts will execute whenever a user accesses an injected page, posing a significant security risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Oracle VVM VirtualBox
  • Oracle VM Virtualbox

Affected Vendors

  • Oracle Corp

Advisories, Assessments, and Mitigations