CVE-2024-4180
Published: 04 June 2024
Summary
CVE-2024-4180 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Stellarwp The Events Calendar. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 2.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Events Calendar WordPress plugin before version 6.4.0.1 is affected by an improper input sanitization flaw when rendering certain views over AJAX. The issue is tracked as CVE-2024-4180 and is classified under CWE-79, resulting in a CVSS 3.1 score of 9.1 that reflects unauthenticated network access with high impact on confidentiality and integrity.
An unauthenticated attacker can supply crafted content that is processed without adequate escaping, allowing cross-site scripting payloads to execute in the context of other users who view the affected calendar pages. Successful exploitation can lead to session hijacking, administrative takeover, or arbitrary actions on behalf of site visitors and editors.
The supplied references point to WPScan entries that identify the vulnerable plugin versions but do not detail specific mitigation steps beyond the availability of the 6.4.0.1 release. The associated EPSS score sits at 0.4237 with no indicated rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32739
Vulnerability details
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.