CVE-2024-12024 Overview
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in versions up to and including 4.0.7.3. The flaw resides in the em_ticket_category_data and em_ticket_individual_data parameters, which suffer from insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrative user views an affected page. Exploitation requires the plugin's "Guest Submissions" setting to be enabled, which is disabled by default. The vulnerability affects the metagauss:eventprime component distributed through the WordPress plugin repository.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, leading to administrator session hijacking, credential theft, and site takeover when the "Guest Submissions" option is enabled.
Affected Products
- Metagauss EventPrime plugin for WordPress, all versions up to and including 4.0.7.3
- WordPress sites using the EventPrime – Events Calendar, Bookings and Tickets plugin
- Deployments with the "Guest Submissions" setting enabled
Discovery Timeline
- 2024-12-17 - CVE-2024-12024 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12024
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting flaw affecting ticket-handling logic in the EventPrime plugin. Attacker-supplied values in the em_ticket_category_data and em_ticket_individual_data parameters are stored server-side without adequate sanitization. When an administrator opens the affected event or ticket management page, the injected payload is rendered without proper output escaping and executes in the administrator's browser session.
Because the attack path is exposed through the guest submission workflow, no authentication is required to plant the payload. The resulting script runs with the privileges of any user who later views the malicious content, including WordPress administrators. Successful exploitation can lead to session token theft, forced administrative actions, plugin installation, or persistent backdoors on the site.
Root Cause
The root cause is missing input sanitization on the two ticket parameters combined with missing output escaping when the stored values are rendered. Referenced source paths include admin/partials/metaboxes/meta-box-tickets-panel-html.php, includes/class-ep-ajax.php, and includes/class-eventprime-sanitizer.php, where the sanitizer routines fail to strip or encode HTML and JavaScript payloads before persistence and rendering.
Attack Vector
The attack is delivered over the network and requires user interaction from an administrative user to trigger execution. An unauthenticated attacker submits a crafted event or ticket through the guest submission form, embedding a JavaScript payload in em_ticket_category_data or em_ticket_individual_data. The payload is stored in the WordPress database. When a WordPress administrator later loads the ticket panel or the affected front-end page, the browser executes the payload in the administrator's authenticated context.
See the Wordfence Vulnerability Report and the affected source code in WordPress Meta Box Ticket Code for technical details.
Detection Methods for CVE-2024-12024
Indicators of Compromise
- Presence of HTML tags, <script> elements, or JavaScript event handlers such as onerror= or onload= in stored EventPrime ticket records
- Unexpected guest event submissions containing encoded payloads in em_ticket_category_data or em_ticket_individual_data
- Administrator browser sessions issuing unusual outbound requests immediately after loading the EventPrime ticket panel
- New WordPress administrator accounts or plugin installations following administrator visits to event pages
Detection Strategies
- Inspect the WordPress postmeta and EventPrime ticket tables for stored values containing HTML or JavaScript syntax
- Review web server access logs for POST requests to EventPrime AJAX endpoints from unauthenticated sources
- Correlate administrator page views on EventPrime screens with outbound network traffic to unfamiliar domains
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) rule set that inspects EventPrime AJAX parameters for script tags and event handlers
- Monitor WordPress audit logs for new administrator account creation, role changes, and plugin installations
- Alert on modifications to wp-config.php, theme files, and the WordPress uploads directory following EventPrime activity
How to Mitigate CVE-2024-12024
Immediate Actions Required
- Update the EventPrime plugin to a version later than 4.0.7.3 that addresses this issue
- Disable the "Guest Submissions" setting in EventPrime until the plugin is patched
- Audit existing ticket and event submissions for embedded scripts and remove any malicious entries
- Rotate WordPress administrator credentials and invalidate active sessions if the site accepted guest submissions while vulnerable
Patch Information
Metagauss has issued fixes tracked through the WordPress plugin repository. Site owners should upgrade the EventPrime – Events Calendar, Bookings and Tickets plugin to the latest available release beyond 4.0.7.3. Refer to the Wordfence Vulnerability Report for patched version details and the affected source lines in WordPress AJAX Class Code.
Workarounds
- Set the EventPrime "Guest Submissions" option to disabled, which prevents unauthenticated exploitation
- Restrict access to /wp-admin/admin-ajax.php EventPrime actions using WAF rules or plugin-level allowlists
- Require authentication and role-based approval before any user-submitted event content is rendered to administrators
- Apply a Content Security Policy (CSP) that blocks inline script execution on WordPress administrative pages
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
