CVE-2024-2111 in Events Manager Plugin
Summary
by MITRE • 03/28/2024
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/13/2026
The vulnerability identified as CVE-2024-2111 affects the Events Manager plugin for WordPress, a widely used calendar and booking management solution that has been installed on numerous websites worldwide. This plugin facilitates event creation, booking systems, ticket management, and various calendar functionalities for WordPress sites. The specific vulnerability lies within the handling of physical location data input fields, where the plugin fails to properly sanitize user-supplied data before storing it in the database. This weakness exists across all versions up to and including 6.4.7.1, making it a significant concern for WordPress administrators who rely on this plugin for their event management needs.
The technical flaw manifests as a stored cross-site scripting vulnerability that operates through the physical location parameter field within the Events Manager plugin. When authenticated users with contributor-level permissions or higher submit event data containing malicious script code in the physical location field, the plugin stores this unfiltered input without proper sanitization. The vulnerability stems from insufficient input validation and inadequate output escaping mechanisms that should normally protect against malicious code injection. This allows attackers to embed malicious JavaScript code that persists in the database and executes whenever any user accesses pages containing the compromised location data.
The operational impact of this vulnerability is substantial as it enables authenticated attackers to execute arbitrary web scripts in the context of affected websites. Since the vulnerability requires only contributor-level permissions or higher, it can be exploited by users who already have some level of access to the WordPress administration panel. This means that malicious users who have gained contributor access through social engineering, credential theft, or other means can inject persistent malicious code that will execute whenever legitimate users view event pages. The stored nature of the XSS vulnerability ensures that the malicious scripts will run every time affected pages are loaded, potentially leading to session hijacking, data theft, or further compromise of the website and its users.
This vulnerability aligns with CWE-79, which describes Cross-Site Scripting flaws, and represents a classic case of insecure input handling that violates fundamental web security principles. The ATT&CK framework categorizes this as a technique for code injection, specifically under the T1566.001 sub-technique for "Phishing with Malicious Attachments" and potentially T1059.001 for "Command and Scripting Interpreter" if the malicious code executes system commands. Organizations should immediately upgrade to version 6.4.7.2 or later to address this vulnerability, as the fix includes proper input sanitization and output escaping mechanisms. Additionally, administrators should implement role-based access controls to limit contributor permissions, monitor user activities for suspicious behavior, and consider implementing content security policies to mitigate potential exploitation. Regular security audits and vulnerability assessments should be conducted to identify and remediate similar issues in other plugins and themes.