CVE-2021-24724 Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting

What is CVE-2021-24724?

CVE-2021-24724 is a medium-severity cross-site scripting vulnerability in Unknown Timetable and Event Schedule by MotoPress, published on 13 Sep 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

Weakness: CWE-79

Which versions are affected by CVE-2021-24724?

It affects 1 product.

Products include Motopress Timetable and Event Schedule.

How do I fix CVE-2021-24724?

No fix has been published for CVE-2021-24724 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24724 being exploited?

There is no known exploitation of CVE-2021-24724 in the wild and no public exploit code.

Other vulnerabilities in Unknown Timetable and Event Schedule by MotoPress

• CVE-2020-36840 Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization High 7.3
• CVE-2021-24585 Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure Medium 6.5
• CVE-2021-24584 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update Medium 5.4
• CVE-2021-24583 Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion Medium 4.3
• CVE-2022-2843 MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting Low 3.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c847-r6f2-c2wj.