Unscored severity · published May 13, 2014
CVE-2013-1407
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Events Manager · Netweblogic
through 5.3.4; 5.3; 5.3.1; 5.3.2; 5.3.2.1; 5.3.3 · source: NVD
EM
Events Manager Pro · Netweblogic
through 2.2.7; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1407
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1407
Exploit
http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.html
Patch
http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update
Exploit
https://www.htbridge.com/advisory/HTB23139
More from Events Manager
5.4
CVE-2018-0576
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified…