CVE-2021-24813— Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting
Quick assessment
Affected
Unknown Events Made Easy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 插件 Events Made Easy 2.2.24之前版本存在跨站脚本漏洞，该漏洞源于插件对于自定义字段名缺少有效的过滤与转义，这允许高权限用户执行跨站脚本攻击，即使未过滤的html功能被禁止的情况下仍能执行攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24813
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting
Source: CVE Program / CVE List V5
Vulnerability Description
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 插件 Events Made Easy 2.2.24之前版本存在跨站脚本漏洞，该漏洞源于插件对于自定义字段名缺少有效的过滤与转义，这允许高权限用户执行跨站脚本攻击，即使未过滤的html功能被禁止的情况下仍能执行攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Events Made Easy | 2.2.24 ~ 2.2.24 | - |
|
II. Public POCs for CVE-2021-24813
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24813
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-24813 (1)
-
Changeset 2607749 – WordPress Plugin Repository x_refsource_CONFIRM
Vendor Advisories for CVE-2021-24813 (1)
Same Patch Batch · Unknown · 2021-11-01 · 30 CVEs total
| CVE-2021-24716 | Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting | |
| CVE-2021-24809 | BP Better Messages < 1.9.9.41 - Multiple CSRF | |
| CVE-2021-24808 | BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting | |
| CVE-2021-24799 | Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF | |
| CVE-2021-24794 | Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24793 | WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24789 | Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24781 | Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value Change | |
| CVE-2021-24773 | WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24770 | Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload | |
| CVE-2021-24757 | Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload | |
| CVE-2021-24742 | Logo Slider and Showcase < 1.3.37 - Editor Plugin's Settings Update | |
| CVE-2021-24723 | WP Reactions Lite < 1.3.6 - Authenticated Stored Cross Site Scripting | |
| CVE-2021-24722 | Restaurant Menu by MotoPress < 2.4.2 - Admin+ Stored Cross Site Scripting | |
| CVE-2021-24717 | AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation | |
| CVE-2015-10001 | WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24715 | WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site Scripting | |
| CVE-2021-24685 | Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting | |
| CVE-2021-24682 | Cool Tag Cloud < 2.26 - Contributor+ Stored Cross-Site Scripting | |
| CVE-2021-24624 | MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Events Made Easy
-
CVE-2026-28162
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scri -
CVE-2026-75963
Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Loc -
CVE-2026-14842
Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass -
CVE-2026-14843
Events Made Easy < 3.1.4 - Unauthenticated Person Data Modif -
CVE-2026-59557
WordPress Events Made Easy plugin <= 3.1.3 - Broken Access C
Same vendor: Unknown
-
CVE-2026-94274
YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Di -
CVE-2026-94297
Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitra -
CVE-2026-96886
Course Booking System < 7.0.9 - Unauthenticated Attendee PII -
CVE-2026-97316
Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF vi -
CVE-2026-92424
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Qu
Same weakness: CWE-79
-
CVE-2026-103590
QloApps through 1.7.0 Reflected XSS via Length of Stay Field -
CVE-2026-103589
QloApps through 1.7.0 Reflected XSS via Room Type Editor -
CVE-2026-103588
QloApps through 1.7.0 Reflected XSS via exceptions field -
CVE-2026-103587
QloApps through 1.7.0 Reflected XSS via Book Now Search Para -
CVE-2026-47096
AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter
V. Comments for CVE-2021-24813
No comments yet