← CVE Intelligence

CVE-2021-24927

My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting PUBLISHED

Description (CNA)

The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

Affected (CNA)

Vendor / productVersions
Unknown / My Calendaraffected 3.2.18 before 3.2.18

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.