CVE-2024-10703: 
WordPress vulnerability analysis and mitigation

CVE-2024-10703 affects the Registrations for the Events Calendar WordPress plugin versions before 2.13.4. The vulnerability was discovered and reported by Krugov Artyom from CleanTalk Research. The issue was publicly disclosed on March 3, 2025, and has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) (NVD, WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. This security flaw specifically affects the Form Settings section within the Registration plugin panel, where the Custom Text/Labels Display template field is vulnerable to XSS injection. The vulnerability has been assigned a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity (NVD).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting (XSS) attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite setups. This could potentially lead to the execution of malicious JavaScript code in users' browsers (WPScan).

The vulnerability has been patched in version 2.13.4 of the Registrations for the Events Calendar plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).