Eventprime
CVE-2024-29776
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.
AnalysisAI
Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.3.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.3.9. Affected products include: Metagauss Eventprime. Version information: through 3.3.9..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Eventprime
View allThe EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing use
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the p
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in
This is a PHP Object Injection vulnerability in the Metagauss EventPrime WordPress plugin (eventprime-event-calendar-man
Missing Authorization vulnerability in Metagauss EventPrime.3.4. Rated critical severity (CVSS 9.8), this vulnerability
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attack
PHP Object Injection in the EventPrime event-calendar-management WordPress plugin (versions 4.3.4.1 and earlier) allows
Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Cont
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attacke
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attacke
Missing Authorization vulnerability in Metagauss EventPrime.3.9. Rated high severity (CVSS 8.2), this vulnerability is r
Unauthenticated PHP Object Injection in the EventPrime event calendar plugin for WordPress (versions <= 4.3.2.1) allows
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today