CVE-2024-8701

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-87024.8The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users s CVE-2024-87036.1The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could al CVE-2024-87047.2The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 CVE-2024-87056.3A vulnerability was found in Shandong Star Measurement and Control Equipment Heating Network Wireless Monitoring System 5.6.2 and classified CVE-2024-87066.5A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /CVE-2024-87074.3A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affe CVE-2024-87086.1A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been rated as problematic. This issue affects so CVE-2024-87098.8A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is the function de CVE-2024-87108.8A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Affected by this vulnerability is an unknown fun CVE-2024-87117.5A vulnerability, which was classified as problematic, has been found in SourceCodester Food Ordering Management System 1.0. Affected by this CVE-2024-87126.1The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate CVE-2024-87136.1The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria