WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. id: CVE-2021-24498 info: name: WordPress...

CVE-2021-24498

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue...

CVE-2021-24498

creationtimestamp| type| source ---|---|--- 2021-08-02 14:27:18+00:00| seen| https://t.me/cibsecurity/26653 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24498.yaml 2025-07-08 21:02:37+00:00| seen|...

CVE-2021-24498

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue...

CVE-2021-24498

The Calendar Event Multi View WordPress plugin (versions prior to 1.4.01 ) is vulnerable to an unauthenticated reflected Cross-Site Scripting (XSS) issue. The root cause is the failure to sanitize or escape the 'start' and 'end' GET parameters before they are outputted on the php/edit.php page. S...