CVE-2023-47525 WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

What is CVE-2023-47525?

CVE-2023-47525 is a medium-severity cross-site scripting vulnerability in Event Monster – Event Management, Tickets Booking, Upcoming Event, published on 21 Dec 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2.

Weakness: CWE-79

Which versions are affected by CVE-2023-47525?

It affects 1 product.

Products include Awplife Event Monster.

How do I fix CVE-2023-47525?

No fix has been published for CVE-2023-47525 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-47525 being exploited?

There is no known exploitation of CVE-2023-47525 in the wild and no public exploit code.

Other vulnerabilities in Event Monster – Event Management, Tickets Booking, Upcoming Event

• CVE-2024-1895 Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta High 7.5
• CVE-2022-3720 Event Monster < 1.2.1 - Admin+ SQLi High 7.2
• CVE-2024-11396 Event monster <= 1.4.3 - Information Exposure Via Visitors List Export Medium 5.3
• CVE-2024-5059 WordPress Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure vulnerability Medium 5.3
• CVE-2022-3336 Event Monster < 1.2.0 - Visitors Deletion via CSRF Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m4r9-8h98-x643.