CVE-2024-7982

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-7982
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-7982.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-7982
Downstream
Published
2024-11-08T06:00:03Z
Modified
2026-10-06T02:32:02Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS
Details

The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

Database specific 
{
    "cna_assigner":  "WPScan",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7982.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "2.12.4"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "fixed":  "2.12.4"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

WordPress:Plugin / registrations-for-the-events-calendar

Package

Name
registrations-for-the-events-calendar

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.12.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-7982.json"