CVE-2024-4180

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownThe Events Calendar< 6.4.0.1

References

Timeline

Published
Jun 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-418007.5Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker iCVE-2024-418016.1OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of CVE-2024-418028.1Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for FiCVE-2024-418034.9Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for FiCVE-2024-418046.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for AddCVE-2024-418056.1Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cCVE-2024-418065.3The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts iCVE-2024-418085.4The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log.CVE-2024-418096.1OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-siCVE-2024-41818.8A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework froCVE-2024-418106.1Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains aCVE-2024-418113.9ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, suscep
CVE-2024-4180: Critical severity, CVSS 9.1 | Vulnix