Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting
Description
The Timetable and Event Schedule plugin before 2.3.19 fails to sanitize parameters, allowing author-level authenticated stored XSS.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
The Timetable and Event Schedule plugin before 2.3.19 fails to sanitize parameters, allowing author-level authenticated stored XSS.
Vulnerability
The Timetable and Event Schedule by MotoPress WordPress plugin versions before 2.3.19 lack proper sanitization of certain parameters. This flaw enables stored cross-site scripting (XSS) attacks [2]. The vulnerability is present in the plugin's event scheduling functionality, reachable through the WordPress admin interface [1].
Exploitation
An attacker with author-level privileges or higher can inject malicious JavaScript into parameters that are not sanitized. When other users (including administrators) view the affected event, the script executes in their browser. The attack requires no special network position beyond access to the WordPress backend [1][2].
Impact
Successful exploitation results in stored XSS, allowing the attacker to execute arbitrary JavaScript in the context of a victim's session. This can lead to information disclosure, session hijacking, or unauthorized actions performed on behalf of the victim. Both frontend and backend users are at risk [1][2].
Mitigation
The vulnerability is fixed in version 2.3.19. Users should update the plugin to this release or later. As of the publication date (2021-09-13), no other mitigations are documented. The plugin is not listed on CISA's KEV [2].
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- WordPress/Timetable and Event Schedule by MotoPressdescription
- Range: <2.3.19
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
3- plugins.trac.wordpress.org/changeset/2573479/mitrex_refsource_CONFIRM
- wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eebmitrex_refsource_MISC
- www.trustwave.com/en-us/resources/security-resources/security-advisories/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.