What’s Vulnerable › Vulnerabilities

CVE-2021-24724: Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-13 · updated 2026-06-17
• Weakness: CWE-79

Description

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

Affected products

• Timetable and Event Schedule by MotoPress: before 2.3.19 — fixed in 2.3.19

How to fix

Upgrade to a fixed version: Timetable and Event Schedule by MotoPress 2.3.19. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2573479/
• https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235
• https://plugins.trac.wordpress.org/changeset/2573479/
• https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235

Get alerted when CVE-2021-24724 or the next vulnerability affects your stack