ExploitCVE-2023-6005
Improper Encoding or Escaping of Output (CWE-116)
Published: Jan 16, 2024 / Updated: 10mo ago
010
CVSS 4.8EPSS 0.05%Medium
CVE info copied to clipboard
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Timeline
CVE Assignment
NVD published the first details for CVE-2023-6005
Jan 16, 2024 at 8:15 AM
First Article
Feedly found the first article mentioning CVE-2023-6005. See article
Jan 16, 2024 at 4:24 PM / National Vulnerability Database
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Jan 16, 2024 at 4:24 PM
EPSS
EPSS Score was set to: 0.05% (Percentile: 11.9%)
Jan 24, 2024 at 7:26 PM
Affected Systems
Myeventon/eventon
+null more
Exploits
https://wpscan.com/vulnerability/fa4eea26-0611-4fa8-a947-f78ddf46a56a/
+null more
Attack Patterns
CAPEC-104: Cross Zone Scripting
+null more
News
CVE-2023-6005 Exploit
CVE Id : CVE-2023-6005 Published Date: 2024-01-19T14:27:00+00:00 The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). inTheWild added a link to an exploit: https://wpscan.com/vulnerability/fa4eea26-0611-4fa8-a947-f78ddf46a56a/
EVENTON CVE-2023-6005 CVE-2023-6005 The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). https://www. cve.org/CVERecord?id=CVE-2023- 6005 https:// wpscan.com/vulnerability/fa4ee a26-0611-4fa8-a947-f78ddf46a56a/ # EventON # CVE_2023_6005 # bot
CVE-2023-6005
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...
CVE-2023-6005
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).