WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. id: CVE-2021-24498 info: name: WordPress...

CVE-2021-24498

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue...

CVE-2021-24498

creationtimestamp| type| source ---|---|--- 2021-08-02 14:27:18+00:00| seen| https://t.me/cibsecurity/26653 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24498.yaml 2025-07-08 21:02:37+00:00| seen|...

CVE-2021-24498

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue...

CVE-2021-24498

CVE-2021-24498 affects the WordPress Calendar Event Multi View plugin earlier than v1.4.01. The vulnerability is a reflected XSS where the plugin does not sanitize/escape the start and end GET parameters before outputting them in php/edit.php. Impact, as described, is injection of malicious scrip...