Input validation vulnerability in Event Monster – Event Management, Tickets Booking, Upcoming Event 1.3.2

The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to a type of malicious attack called Stored Cross-Site Scripting. This type of attack can be used by someone with administrator-level permissions on a multi-site installation or an installation where a certain setting (unfiltered_html) has been disabled. This attack can be used to inject malicious code which will execute when a user accesses an injected page. All versions of the plugin are vulnerable up to, and including, version 1.3.2 due to insufficient input sanitization and output escaping.