CVE-2023-4250

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	EventPrime	< 3.2.0

References

https://wpscan.com/vulnerability/9c271619-f478-45c3-91d9-be0f55ee06a2Exploit, Third Party Advisory
https://wpscan.com/vulnerability/9c271619-f478-45c3-91d9-be0f55ee06a2Exploit, Third Party Advisory
https://wpscan.com/vulnerability/9c271619-f478-45c3-91d9-be0f55ee06a2Exploit, Third Party Advisory

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-425014.3Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This is CVE-2023-425025.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header,CVE-2023-425035.5Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apac CVE-2023-425046.5An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possib CVE-2023-425054.3An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the conn CVE-2023-425067.8Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulne CVE-2023-425077.8Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information m CVE-2023-425086.5JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unaut CVE-2023-425097.5JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled e CVE-2023-42514.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in CVE-2023-42525.3The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase booki CVE-2023-425207.5Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Se