CVE-2022-0212 SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting

The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0212

The CVE-2022-0212 entry concerns the WordPress SpiderCalendar/Spider Calendar plugin (versions up to 1.5.65). The root cause is failure to sanitize and escape the callback parameter before echoing it in the page via the window AJAX action, enabling Reflected Cross-Site Scripting for unauthenticat...