CVE-2024-12024: 
WordPress vulnerability analysis and mitigation

CVE-2024-12024 affects the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin versions up to and including 4.0.5.3. The vulnerability was discovered and disclosed on December 17, 2024, and involves a Stored Cross-Site Scripting issue via the em_ticket_category_data and em_ticket_individual_data parameters (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's ticket management functionality. It has received a CVSS v3.1 base score of 6.1 (MEDIUM) from NIST and 7.2 (HIGH) from Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever an administrative user accesses an injected page. The impact is contingent on the 'Guest Submissions' setting being enabled, which is disabled by default (NVD).

Multiple patches have been implemented in the plugin's codebase, addressing the vulnerability in various files including meta-box-tickets-panel-html.php, class-ep-ajax.php, and class-eventprime-sanitizer.php. Users should update to a version newer than 4.0.5.3 to protect against this vulnerability (Wordfence).