CVE-2022-25611

Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].

Score

CVSS 3.1 5.4 Medium

Status

Modified - audit@patchstack.com

Published

2022-03-25

Last modified

2026-04-28

Weaknesses

CWE-79

Affected products

• Simple Event Planner (Presstigers)
• Simple Event Planner Wordpress Plugin (Presstigers)

References

• https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-authenti…
• https://wordpress.org/plugins/simple-event-planner/#developers