The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2019/10/16/4 | Exploit Mailing List Third Party Advisory |
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-03_WordPress_Plugin_Events_Manager | Exploit Third Party Advisory |
https://wordpress.org/plugins/events-manager/#developers | Product Third Party Advisory |
https://wpvulndb.com/vulnerabilities/9916 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-10-16T14:02:04
Updated: 2019-10-16T17:06:39
Reserved: 2019-09-19T00:00:00
Link: CVE-2019-16523
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-10-16T15:15:15.397
Modified: 2019-10-18T20:25:36.000
Link: CVE-2019-16523
JSON object: View
Redhat Information
No data.
CWE