1) Stored cross-site scripting
Description
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the (1) form-first-name, form-last-name, form-phone and (2) em_upload_image, logo_size, em_logo_size, em_date_time_heading, em_organizer_heading, em_orginizer_name[], em_value_email HTTP POST parameters, when adding an event. A remote attacker can send a specially crafted HTTP request, permanenlty store arbitrary HTML and script code and execute in in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install updates from vendor's website.
External links
https://docs.google.com/document/d/1rlijr98h9jReuY85eX00JgvNQHKRhzl4I5bRypMA490/edithttps://plugins.trac.wordpress.org/changeset/2095474/event-monster
Support the originator by clicking the read the rest link below.
