Lucene search
HistoryAug 03, 2021 - 12:00 a.m.
Availability Calendar < 1.2.2 - Authenticated Stored Cross-Site Scripting
0.001 Low
EPSS
Percentile
24.8%
The plugin does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Create a new category via the plugin (/wp-admin/admin.php?page=owaccategory), add the following payload in the Name field: <script>alert(/XSS/)</script>, then view a page/post where the associated Category Shortcode is embedRelated
nvd
nvd
CVE-2021-24604
2021-09-20 10:15:08
prion
prion
Cross site scripting
2021-09-20 10:15:00
cvelist
cvelist
cve
cve
CVE-2021-24604
2021-09-20 10:15:08
wpvulndb
wpvulndb
Availability Calendar < 1.2.2 - Authenticated Stored Cross-Site Scripting
2021-08-03 00:00:00