CVE-2021-24498: vulnerability in Calendar Event Multi View
Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 3.5%
from disclosure to weapon
Published on NVDAug 2
VulnCheck+1406d
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
Affected products
Unknown · Calendar Event Multi ViewRelated CVEs — Calendar Event Multi View
In the same product, most dangerous first.