Medium severity · published Aug 16, 2022
CVE-2022-2843
MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument post_title with the input <img src=x onerror=alert`2`> leads to cross site scripting. The attack may be launched remotely. VDB-206486 is the identifier assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Timetable and Event Schedule · MotoPress
All versions, or not specified · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2843
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2843
Third Party Advisory
https://vuldb.com/?id.206486
More from Timetable and Event Schedule
9.8
CVE-2020-36840
Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
6.5
CVE-2021-24585
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the…
6.1
CVE-2022-2844
MotoPress Timetable and Event Schedule Calendar cross site scripting
5.5
CVE-2024-39630
WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability
5.4
CVE-2021-24584
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability…