Wordpress Events Manager Extended Plugin Persistent XSS Vulnerability

2010-09-06 10:15:15

# Author: Craw
# Email: [email protected]
# Software Link: http://wordpress.org/extend/plugins/events-manager-extended/
# Version: 3.1.2
# Category: webapplications

=======================================================


[+] ExploiT [1] : If you are allowed to leave a comment:

Persistent XSS Vulnerability: You can inject Javascript Code in your comment.
The Code will be displayed below the event.


[+] ExploiT [2] : If you are allowed to book an event:

Persistent XSS Vulnerability: You can inject Javascript Code in [Name] , [Email] , [Phonenumber] , [Comment]
The Code will be displayed in the Wordpress Backend -> http://www.site.com/wp-admin/admin.php?page=events-manager-people


=======================================================
Greetz @ LUXEMBOURG
=======================================================

Fixes

No fixes

In order to submit a new fix you need to be registered.