CVE-2024-1320: 
WordPress vulnerability analysis and mitigation

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1320) via the 'offline_status' parameter in versions up to and including 3.4.3. The vulnerability was discovered and disclosed on March 9, 2024, affecting the WordPress plugin developed by Metagauss (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's handling of the 'offline_status' parameter. The issue has been assigned a CVSS v3.1 base score of 6.1 (Medium) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a slightly higher score of 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. This can lead to potential client-side attacks and compromise of user data (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring no privileges and low attack complexity. The attack vector is network-accessible, though some variations of the CVSS scoring suggest user interaction may be required for successful exploitation (NVD).

Users should update to version 3.4.4 or later of the EventPrime plugin to address this vulnerability (NVD).