1) Stored cross-site scripting
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the (1) form-first-name, form-last-name, form-phone and (2) em_upload_image, logo_size, em_logo_size, em_date_time_heading, em_organizer_heading, em_orginizer_name, em_value_email HTTP POST parameters, when adding an event. A remote attacker can send a specially crafted HTTP request, permanenlty store arbitrary HTML and script code and execute in in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Install updates from vendor's website.
Support the originator by clicking the read the rest link below.