CVE-2024-6931: The Events Calendar XSS Vulnerability

CVE-2024-6931 Overview

The Events Calendar plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the RSVP name field. The flaw affects all versions up to and including 6.6.3. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary JavaScript into RSVP submissions. Injected payloads execute in the browser of any user who loads the affected page, including administrators viewing RSVP data. The plugin is widely deployed across WordPress event sites, expanding the attack surface for opportunistic exploitation. This vulnerability is classified under [CWE-79] and carries an EPSS score of 16.723%, placing it in the 96.9th percentile for exploitation likelihood.

Critical Impact
Unauthenticated attackers can persist malicious JavaScript through public RSVP forms, enabling session hijacking, credential theft, and administrative account takeover when victims render the injected content.

Affected Products

StellarWP The Events Calendar plugin for WordPress, versions up to and including 6.6.3
WordPress sites using the plugin with public RSVP functionality enabled
Administrative dashboards rendering unescaped RSVP attendee data

Discovery Timeline

2024-09-27 - CVE-2024-6931 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6931

Vulnerability Analysis

The Events Calendar plugin exposes RSVP functionality that lets site visitors submit their name to reserve attendance for an event. The plugin fails to properly sanitize the RSVP name field on input and does not escape the stored value on output. As a result, an unauthenticated attacker can submit an RSVP containing HTML or JavaScript payloads. When any user, including a site administrator, later loads a page that renders the RSVP attendee list, the browser interprets the payload as executable script within the site's origin.

The persistent nature of the flaw amplifies its impact. Payloads remain in the database until removed and fire against every viewer of the affected page. Attackers can use this to steal session cookies, perform actions on behalf of authenticated users, deface content, or pivot toward administrator account compromise via forced actions against WordPress admin endpoints.

Root Cause

The root cause is missing input sanitization and missing output escaping on the RSVP name parameter. The plugin trusts user-supplied form data and writes it directly to the RSVP attendee record. On render, the value is emitted into the HTML document without applying WordPress functions such as esc_html() or wp_kses(). This is a textbook stored XSS pattern falling under [CWE-79].

Attack Vector

Exploitation requires only network access to a WordPress site running the vulnerable plugin with an event that accepts RSVPs. The attacker submits an RSVP form and places a JavaScript payload into the name field. No authentication is required. Execution occurs when an authenticated administrator or another visitor loads the page or dashboard view that displays attendee names. User interaction is required only in that the victim must load the affected page.

See the Wordfence Vulnerability Report for additional technical context on the affected code path.

Detection Methods for CVE-2024-6931

Indicators of Compromise

RSVP attendee records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the name field
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains after viewing event pages
New or modified WordPress administrator accounts created shortly after an administrator viewed an RSVP list
WordPress database entries in the tribe_tickets or related plugin tables containing encoded JavaScript payloads

Detection Strategies

Query the WordPress database for RSVP name values matching common XSS payload patterns and HTML tag signatures
Deploy a Web Application Firewall (WAF) rule to inspect POST requests to RSVP submission endpoints for script content
Monitor for anomalous JavaScript execution on event pages using Content Security Policy (CSP) violation reports
Review WordPress access logs for high-volume RSVP submissions from single source IP addresses

Monitoring Recommendations

Log and alert on WordPress plugin version inventory changes across managed sites
Correlate administrator dashboard access with subsequent privileged actions to identify session hijacking attempts
Ingest WordPress and web server telemetry into a centralized data lake to enable retroactive hunting for injected payloads

How to Mitigate CVE-2024-6931

Immediate Actions Required

Upgrade The Events Calendar plugin to a version later than 6.6.3 that contains the sanitization fix
Audit existing RSVP attendee records for HTML or script content and purge malicious entries
Rotate WordPress administrator session cookies and reset credentials for any account that viewed affected event pages
Restrict RSVP submissions using CAPTCHA or rate limiting to reduce automated exploitation attempts

Patch Information

StellarWP addressed the vulnerability through the WordPress plugin repository. Review the WordPress Plugin Changeset for the specific code changes that introduce sanitization and output escaping on the RSVP name field. Update via the WordPress admin plugin manager or by pulling the current release from the The Events Calendar plugin page.

Workarounds

Disable public RSVP functionality until the plugin is updated
Deploy a WAF rule to block POST requests containing script tags or common XSS payloads targeting RSVP endpoints
Enforce a strict Content Security Policy that disallows inline script execution on event pages
Restrict access to the WordPress administrator dashboard by IP address to limit exposure of attendee list views

bash

# Example WordPress CLI commands to update the plugin and audit RSVP entries
wp plugin update the-events-calendar
wp db query "SELECT id, post_title FROM wp_posts WHERE post_type='tribe_rsvp_attendees' AND post_title REGEXP '<[a-z]+';"