CVE-2023-45637
📋 TL;DR
Unauthenticated reflected cross-site scripting (XSS) vulnerability in EventPrime WordPress plugin allows attackers to inject malicious scripts via crafted URLs. This affects WordPress sites running EventPrime plugin version 3.1.5 or earlier. Attackers can execute arbitrary JavaScript in victims' browsers when they visit malicious links.
💻 Affected Systems
- EventPrime – Events Calendar, Bookings and Tickets WordPress plugin
📦 What is this software?
Eventprime by Metagauss
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or install malware via drive-by downloads.
Likely Case
Session hijacking, credential theft, defacement of website content, or redirection to phishing pages.
If Mitigated
Limited impact if proper Content Security Policy (CSP) headers are implemented and user input validation is enforced.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but is trivial to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.6 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find EventPrime plugin and click 'Update Now'. 4. Verify plugin version is 3.1.6 or higher.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Add to nginx config: add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
Disable vulnerable plugin
linuxTemporarily disable EventPrime plugin until patched
wp plugin deactivate eventprime-event-calendar-management
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Restrict plugin access to trusted users only using authentication
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > EventPrime version numberCheck Version:
wp plugin get eventprime-event-calendar-management --field=versionVerify Fix Applied:
Verify plugin version is 3.1.6 or higher and test with XSS payloads📡 Detection & Monitoring
Log Indicators:
- Unusual GET requests with script tags in query parameters
- Multiple 404 errors with suspicious parameters
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in URL parameters
SIEM Query:
source="web_logs" AND (url="*<script>*" OR url="*javascript:*")🔗 References
- https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
