My Calendar < 3.4.24 - Authenticated Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)

PoC

1. Use any type of role (as long as you permit it the action to Add Events). 2. Add a new event, and insert the following in the Excerpt field and in the Registration Information field: 3. Edit the event using an Admin account, or browse it on the front end and the alert will trigger.