MDJM Event Management and Mobile Events Manager plugins stored XSS via role creation
An event plugin lets any signed-up user plant scripts for admins.
Summary
Versions through 1.7.8.7 of the WordPress event plugins MDJM Event Management and Mobile Events Manager let any logged-in user, such as a subscriber, create a role with a script in its name. The script runs when an administrator opens a standard user management screen.
Affected when
- Plugin 1.7.8.7 or older installed
- Attacker holds any logged-in account, such as a subscriber
- An administrator opens a standard user management screen
What to do
If you run 1.7.8.7 or older, check that you run a newer version than 1.7.8.7 and read the vendor's advisory. No fixed version is named yet.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen