CVE-2024-1274 My Calendar < 3.4.24 - Authenticated Stored XSS

2024-04-0205:15:41

WPScan

github.com

wordpress

plugin

authenticated

stored xss

cross-site scripting

AI Score

6.1

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:joedolson:my_calendar:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "joedolson",
    "product": "my_calendar",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.4.24",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]