CVE-2021-24606

The CVE-2021-24606 entry affects the Availability Calendar WordPress plugin (before 1.2.1). The root cause is failure to escape the category attribute in the shortcode before it is used in a SQL statement, resulting in an authenticated SQL injection vulnerability. Impact is that a user who can in...

CVE-2021-24604

The CVE-2021-24604 affects the Availability Calendar WordPress plugin (pre-1.2.2). The root cause is failure to sanitize/escape Category Names before they are output in pages/posts using the related shortcode, enabling authenticated, high-privilege users to perform cross-site scripting (XSS). The...