CVE-2021-24496: community_events_project community_events Cross-site Scripting
Vulnerability summary
CVE-2021-24496 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in community_events_project community_events. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-08-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.83%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Community_events_project1 product
- community_events< 1.4.8
Unknown1 product
- community events≥ 1.4.8, < 1.4.8
Wordpress1 product
- community-events< 1.4.8
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/5fd1cb7f-a036-4c5b-9557-0ffd4ef6b834X Refsource MISCExploitThird Party Advisory