Stored XSS Vulnerability in Events Manager Plugin for WordPress

Stored XSS Vulnerability in Events Manager Plugin for WordPress

CVE-2019-16523 · MEDIUM Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.

Learn more about our Wordpress Pen Testing.