CVE-2022-1324 – Event Timeline <= 1.1.5 - Admin+ Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2022-1324

The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed El plugin Event Timeline de WordPress versiones hasta 1.1.5, no sanea ni escapa del texto de la línea de tiempo, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando unfiltered_html está deshabilitado The Event Timeline WordPress plugin through 1.1.6 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed • https://wpscan.com/vulnerability/2ce2a387-acc8-482a-9452-a4d9acb187fd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •