CVE-2024-9865 Overview
CVE-2024-9865 is a Stored Cross-Site Scripting (XSS) vulnerability in the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. The flaw affects all versions up to and including 4.0.4.7. Unauthenticated attackers can inject arbitrary web scripts through the ep_booking_attendee_fields parameter due to insufficient input sanitization and output escaping. The injected payload executes whenever an administrator or user views the transaction log for the affected booking. The vulnerability is categorized as Improper Neutralization of Input During Web Page Generation [CWE-79].
Critical Impact
Unauthenticated attackers can persist malicious JavaScript in booking records, hijacking administrator sessions when transaction logs are viewed.
Affected Products
- Metagauss EventPrime plugin for WordPress, versions <= 4.0.4.7
- WordPress sites using the eventprime-event-calendar-management plugin
- Any site exposing the booking workflow to unauthenticated users
Discovery Timeline
- 2024-10-24 - CVE-2024-9865 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9865
Vulnerability Analysis
The EventPrime plugin exposes a booking submission workflow that accepts attendee data through the ep_booking_attendee_fields parameter. The plugin stores this data in the WordPress database and later renders it inside the transaction log view. The values are neither sanitized on input nor escaped on output, which allows attacker-supplied HTML and JavaScript to render as executable markup in the administrator's browser context.
Exploitation requires no authentication. An attacker submits a crafted booking containing script payloads in attendee fields. When a site operator opens the transaction log for that booking, the payload executes with the operator's privileges. This can be used to create new administrator accounts, exfiltrate session cookies, or pivot into further site compromise.
Root Cause
The root cause is missing input sanitization and missing output escaping on the ep_booking_attendee_fields values. WordPress provides helpers such as sanitize_text_field(), wp_kses(), and esc_html() for this purpose. The affected plugin code paths render stored attendee input directly into the transaction log DOM without applying these controls.
Attack Vector
The attack vector is network-based and requires user interaction from a privileged operator who views the transaction log. Because bookings can be created without authentication, the barrier to persisting the payload is low. The scope is changed: the injected script runs in the security context of the WordPress admin interface even though the payload was submitted through the public-facing booking form.
Exploitation follows the standard stored XSS pattern: submit a booking with attendee field values containing an HTML event handler or <script> tag, wait for an administrator to open the transaction log, and the payload executes in that session. See the Wordfence Vulnerability Report for the technical writeup.
Detection Methods for CVE-2024-9865
Indicators of Compromise
- Booking records containing HTML tags, <script> elements, or JavaScript event handlers (onerror, onload, onmouseover) in attendee field values.
- Unexpected outbound requests from administrator browsers immediately after viewing an EventPrime transaction log.
- Creation of new WordPress administrator accounts or modification of user roles shortly after transaction log access.
- Plugin or theme file modifications timestamped near administrator interactions with EventPrime bookings.
Detection Strategies
- Query the WordPress wp_postmeta and EventPrime-specific tables for attendee field values containing <, >, script, or javascript: substrings.
- Inspect web server access logs for POST requests to EventPrime booking endpoints containing URL-encoded script payloads.
- Enforce a Content Security Policy that blocks inline script execution and report violations through a monitoring endpoint.
Monitoring Recommendations
- Monitor the WordPress users table for unauthorized administrator additions or role escalations.
- Alert on file integrity changes under wp-content/plugins/ and wp-content/themes/ following administrative sessions.
- Track EventPrime plugin version across managed WordPress fleets and flag any host still running 4.0.4.7 or earlier.
How to Mitigate CVE-2024-9865
Immediate Actions Required
- Update the EventPrime plugin to a version later than 4.0.4.7 that includes the fix from WordPress plugin changeset 3170503.
- Audit existing booking records and transaction logs for stored script payloads and remove any malicious entries.
- Review the WordPress user list and revoke any unauthorized administrator accounts created since the vulnerability window.
- Rotate administrator passwords and invalidate active sessions after patching.
Patch Information
The vendor addressed the issue in the WordPress plugin repository. Apply the update referenced in the WordPress Changeset Update and the WordPress Changeset Comparison. WordPress site administrators should update through the plugins dashboard or by running wp plugin update eventprime-event-calendar-management via WP-CLI.
Workarounds
- Disable the EventPrime plugin until the patched version is deployed.
- Restrict booking form access to authenticated users via a reverse proxy or WordPress access control rules.
- Deploy a Web Application Firewall rule that blocks POST requests containing script tags or JavaScript event handlers in ep_booking_attendee_fields parameters.
# Configuration example
wp plugin update eventprime-event-calendar-management
wp plugin list --name=eventprime-event-calendar-management --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
