CVE-2023-4995

CVE-2023-4995 affects the Embed Calendly plugin for WordPress. The vulnerability is Stored XSS via the calendly shortcode, caused by insufficient sanitization/escaping of shortcode attributes in versions up to 3.6. Authenticated attackers with contributor-level or higher permissions can inject ar...

WordPress Embed Calendly Plugin <= 3.6 is vulnerable to Cross Site Scripting (XSS)

Software Embed Calendly Type Plugin Vulnerable versions = 3.6 Fixed in 3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4995 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b37cc7f4dcca Credits Lana Codes Required privilege...

PT-2023-31420

Name of the Vulnerable Software and Affected Versions Embed Calendly plugin for WordPress versions up to, and including, 3.6 Description The issue is related to Stored Cross-Site Scripting via the 'calendly' shortcode due to insufficient input sanitization and output escaping on user-supplied...

WordPress Plugin Embedded Calendly Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-4995: Improper Neutralization of Input During Web Page Generation

The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

cal.com 访问控制错误漏洞

cal.com is an open source Calendly replacement. A security vulnerability exists in versions of cal.com prior to 2.7 that stems from improper access control...