CVE-2021-24927

The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mcpostlookup AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue...

PT-2021-16371

Name of the Vulnerable Software and Affected Versions: My Calendar WordPress plugin versions prior to 3.2.18 Description: The issue arises from the lack of sanitization and escaping of the callback parameter in the mc post lookup AJAX action, which is accessible to any authenticated user. This...