Lucene search
WPScanCVELIST:CVE-2021-24927HistoryNov 29, 2021 - 8:25 a.m.
CVE-2021-24927 My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting
2021-11-2908:25:52
CWE-79
WPScan
www.cve.org
0.001 Low
EPSS
Percentile
24.9%
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
CNA Affected
[
{
"product": "My Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.2.18",
"status": "affected",
"version": "3.2.18",
"versionType": "custom"
}
]
}
]Related
cve
cve
CVE-2021-24927
2021-11-29 09:15:08
prion
prion
Cross site scripting
2021-11-29 09:15:00
wpvulndb
wpvulndb
My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting
2021-11-01 00:00:00
nvd
nvd
CVE-2021-24927
2021-11-29 09:15:08
cnvd
cnvd
WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-102402)
2021-12-01 00:00:00
wpexploit
wpexploit
My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting
2021-11-01 00:00:00