CVE Database /
CVE-2021-24927
CVE · Medium
CVE-2021-24927 — My Calendar – Accessible Event Manager [my-calendar] < 3.2.18
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24927
|
My Calendar – Accessible Event Manager [my-calendar] < 3.2.18 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 3.2.18
|
3.2.18 |
2021-11-01 |
—
|
CVE-2021-24927
The My Calendar plugin versions prior to 3.2.18 contains a reflected cross-site scripting vulnerability in the mc_post_lookup AJAX action. Any logged-in user can exploit this flaw by injecting malicious scripts through the callback parameter, which the plugin fails to properly sanitize and escape before returning in the response. This allows attackers to execute arbitrary JavaScript in the browsers of other users who interact with the crafted payload.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings