Medium severity · published Feb 6, 2023
CVE-2023-0144
Event Manager and Tickets Selling Plugin for WooCommerce < 3.8.0 - Contributor+ Stored XSS
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Event Manager and Tickets Selling Plugin for WooCommerce ·
before 3.8.0 · source: vendor
EM
Event Manager And Tickets Selling For Woocommerce · Mage-people
before 3.8.0 · source: NVD
Affected product
EM
Event Manager and Tickets Selling Plugin for WooCommerce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0144
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0144
Exploit
https://wpscan.com/vulnerability/d7b3917a-d11f-4216-9d2c-30771d83a7b4
More from Event Manager and Tickets Selling Plugin for WooCommerce
8.8
CVE-2022-0478
Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL Injection