CVE-2024-9864: EventPrime WordPress Plugin XSS Vulnerability

CVE-2024-9864 Overview

CVE-2024-9864 is a stored Cross-Site Scripting (XSS) vulnerability in the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. The flaw affects all versions up to and including 4.0.4.7. It stems from insufficient input sanitization and output escaping in the ticket name field. Unauthenticated attackers can inject arbitrary web scripts that execute when users access the injected page. Exploitation is only possible when front-end users are permitted to submit new events with tickets. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can persist malicious JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

Metagauss EventPrime plugin for WordPress, all versions up to and including 4.0.4.7
WordPress sites permitting front-end event submission with tickets
Site administrators and visitors browsing pages containing malicious ticket names

Discovery Timeline

2024-10-24 - CVE-2024-9864 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9864

Vulnerability Analysis

The EventPrime plugin renders user-supplied ticket names into HTML pages without applying sufficient sanitization on input or escaping on output. When a front-end user submits a new event containing a ticket, the ticket name field accepts arbitrary characters, including HTML tags and JavaScript payloads. The plugin then stores this value in the WordPress database and later echoes it into event pages served to visitors.

Because the injection is stored server-side, the payload persists across sessions and executes for every user who loads the affected page. The attack requires user interaction only in the sense that a victim must visit the compromised page. An attacker exploiting this flaw can hijack authenticated sessions, redirect users to phishing sites, or perform actions in the context of an administrator account.

Root Cause

The root cause is missing input validation and missing output escaping on the ticket name parameter. WordPress provides functions such as sanitize_text_field() for input and esc_html() or esc_attr() for output, but the vulnerable code path in EventPrime through 4.0.4.7 does not apply them consistently to ticket name data.

Attack Vector

Exploitation requires a target WordPress site that has front-end event submission enabled with ticket creation. An unauthenticated attacker submits a new event through the public form and places a JavaScript payload inside the ticket name field. The payload is stored in the database. When any user, including administrators, subsequently views the event page, the browser parses and executes the injected script. Because the vulnerability crosses a security scope boundary, an unauthenticated actor can influence privileged users' sessions. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-9864

Indicators of Compromise

Ticket name fields in the WordPress database containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or event handler attributes
Unexpected outbound requests from browsers rendering event pages to attacker-controlled domains
New administrator accounts, altered user roles, or unauthorized plugin installations following event submissions
Anomalous front-end event submissions from unauthenticated sources containing encoded payloads

Detection Strategies

Query the WordPress database (wp_posts, wp_postmeta, and EventPrime-specific tables) for ticket records containing HTML or JavaScript syntax
Review web server access logs for POST requests to EventPrime front-end submission endpoints with suspicious parameter content
Inspect rendered event pages with a Content Security Policy (CSP) report-only header to surface inline script violations
Correlate WordPress admin session activity with recent event submissions to identify potential post-exploitation actions

Monitoring Recommendations

Enable audit logging for WordPress content changes, especially plugin-managed custom post types created by EventPrime
Monitor for administrator role changes, password resets, and new user creation events that follow ticket submissions
Alert on unusual JavaScript execution patterns reported by browser CSP violation endpoints
Track outbound HTTP requests from web application traffic that reference newly seen domains after event page views

How to Mitigate CVE-2024-9864

Immediate Actions Required

Update the EventPrime plugin to the patched version released after 4.0.4.7
Disable front-end event submission until the plugin is patched if updating cannot occur immediately
Audit existing ticket names in the database and remove or sanitize any entries containing HTML or script content
Rotate credentials and invalidate active sessions for administrator accounts that visited event pages during the exposure window

Patch Information

Metagauss addressed the vulnerability in the plugin release referenced by the WordPress Plugin Changeset 3170503. Site administrators should update through the WordPress plugin dashboard or by deploying the fixed plugin archive to wp-content/plugins/eventprime-event-calendar-management/.

Workarounds

Restrict front-end event submission to authenticated, trusted users through role-based access controls
Deploy a Web Application Firewall (WAF) rule to block requests containing HTML tags in EventPrime ticket parameters
Implement a strict Content Security Policy that disallows inline scripts on event pages
Remove or hide EventPrime event pages from public rendering until patching completes

bash

# Example WordPress WP-CLI commands to update the plugin and audit ticket data
wp plugin update eventprime-event-calendar-management
wp plugin get eventprime-event-calendar-management --field=version
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_title REGEXP '<[a-zA-Z]+' AND post_type LIKE 'em_%';"