Medium severity · published Sep 13, 2021
CVE-2021-24724
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to…
5.4
CVSS
0.9%
EPSS
No
On KEV
Description
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Timetable And Event Schedule · Motopress
before 2.3.19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24724
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24724
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2573479/
Exploit
https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb
Exploit
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235
More from Timetable And Event Schedule
9.8
CVE-2020-36840
Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
6.5
CVE-2021-24585
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the…
6.1
CVE-2022-2844
MotoPress Timetable and Event Schedule Calendar cross site scripting
6.1
CVE-2022-2843
MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting
5.5
CVE-2024-39630
WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability