CVE-2024-6931
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Sep 27, 2024
Updated: Oct 4, 2024
CWE ID 79
Summary
CVE-2024-6931 is a stored Cross-Site Scripting (XSS) vulnerability affecting The Events Calendar plugin for WordPress. This issue, existing in all versions up to 6.6.3, permits unauthenticated attackers to inject malicious scripts into RSVP name fields. As a result, the injected scripts will execute when any user visits a manipulated page. The root cause of this vulnerability lies in insufficient input sanitization and output escaping within the plugin.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.