Cyber Resilience

CVE-2024-4180

CriticalPublic PoC

Published: 04 June 2024

Published
04 June 2024
Modified
29 May 2025
KEV Added
Patch
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.4237 97.5th percentile
Risk Priority 44 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-4180 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Stellarwp The Events Calendar. Its CVSS base score is 9.1 (Critical).

Operationally, ranked in the top 2.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The Events Calendar WordPress plugin before version 6.4.0.1 is affected by an improper input sanitization flaw when rendering certain views over AJAX. The issue is tracked as CVE-2024-4180 and is classified under CWE-79, resulting in a CVSS 3.1 score of 9.1 that reflects unauthenticated network access with high impact on confidentiality and integrity.

An unauthenticated attacker can supply crafted content that is processed without adequate escaping, allowing cross-site scripting payloads to execute in the context of other users who view the affected calendar pages. Successful exploitation can lead to session hijacking, administrative takeover, or arbitrary actions on behalf of site visitors and editors.

The supplied references point to WPScan entries that identify the vulnerable plugin versions but do not detail specific mitigation steps beyond the availability of the 6.4.0.1 release. The associated EPSS score sits at 0.4237 with no indicated rise from a lower baseline.

EU & UK References

Vulnerability details

The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

stellarwp
the events calendar
≤ 6.4.0.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References