CVE-2024-3244

The EmbedPress plugin before version 3.9.15 contains a stored cross-site scripting vulnerability in its embedpress_calendar shortcode that allows authenticated users with contributor privileges or higher to inject malicious scripts into pages by exploiting inadequate sanitization and escaping of shortcode attributes. When these compromised pages are viewed by other users, the injected scripts execute in their browsers. The flaw requires an authenticated attacker with at least contributor-level permissions to exploit.

Based on public CVE data (MITRE/NVD).