CVE-2024-3492 is a stored cross-site scripting vulnerability in the netweblogic Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin. The flaw exists in all versions up to and including 6.4.7.3 due to improper neutralization of input during web page generation (CWE-79). Specifically, the plugin fails to properly sanitize and escape user-supplied attributes in the 'event', 'location', and 'event_category' shortcodes, allowing authenticated users with contributor-level privileges or higher to inject malicious scripts. These scripts execute in the context of any user who views the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or session compromise. The vulnerability does not impact availability and requires authenticated access, limiting the attack scope. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor-level access to trusted users only and consider disabling or restricting use of the affected shortcodes. Monitor for plugin updates from netweblogic that address this vulnerability.