CVE-2013-1407

Published: May 13, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.

Affected (15)

Products: Netweblogic: Events Manager, Events Manager Pro

Netweblogic

2 products

Events Manager

Events Manager Pro

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Netweblogic Events Manager	Up to 5.3.4
Netweblogic Events Manager	Version 5.3.1
Netweblogic Events Manager	Version 5.3.2.1
Netweblogic Events Manager	Version 5.3.2
Netweblogic Events Manager	Version 5.3.3
Netweblogic Events Manager	Version 5.3

Configuration B

9 vulnerable

Vulnerable Software	Affected Versions
Netweblogic Events Manager Pro	Up to 2.2.7
Netweblogic Events Manager Pro	Version 2.2.1
Netweblogic Events Manager Pro	Version 2.2.2
Netweblogic Events Manager Pro	Version 2.2.3
Netweblogic Events Manager Pro	Version 2.2.4
Netweblogic Events Manager Pro	Version 2.2.5
Netweblogic Events Manager Pro	Version 2.2.6
Netweblogic Events Manager Pro	Version 2.2.8
Netweblogic Events Manager Pro	Version 2.2