Login Request a demo
Medium severity · published Aug 16, 2022
CVE-2022-2844
MotoPress Timetable and Event Schedule Calendar cross site scripting
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation of the argument Subject/Location/Description leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206487.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Timetable and Event Schedule · MotoPress
1.4.06 · source: vendor, NVD
Affected product
TA
Timetable and Event Schedule
MotoPress
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2844
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2844
Permissions Required
https://vuldb.com/?id.206487
More from Timetable and Event Schedule
9.8
CVE-2020-36840
Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization
6.5
CVE-2021-24585
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the…
6.1
CVE-2022-2843
MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting
5.5
CVE-2024-39630
WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability
5.4
CVE-2021-24584
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability…