Description

WordPress Plugin The Events Calendar is prone to an open redirect vulnerability because the application fails to properly verify user-supplied input. Exploiting this issue may allow attackers to redirect users to arbitrary web sites and conduct phishing attacks; other attacks are also possible. WordPress Plugin The Events Calendar version 4.1.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 4.1.1.1 or latest

References

https://github.com/moderntribe/the-events-calendar/commit/9b945d4c4df8c4f3fa35726aa64bbf6c08b9e3a9#diff-eb6b6c90251ab33cee784713c451e6d8R314

https://wordpress.org/plugins/the-events-calendar/changelog/

Related Vulnerabilities

WordPress Plugin Slimstat Analytics Security Bypass (5.0.5.1)

WordPress Plugin WP Banners Lite Cross-Site Scripting (1.40)

WordPress Plugin Super Interactive Maps for WordPress SQL Injection (2.1)

WordPress Plugin GDPR Cookie Consent Security Bypass (1.8.2)

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-0791)

Severity

High

Classification

CWE-601 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Url Redirection