Skip to content
Sign in
5.4 Medium

CVE-2024-1274 The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users…

Description

The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)

Affected products and versions

Product Affected versions Fixed in
My Calendar 3.4 earliest → < 3.4.24 3.4.24
my_calendar 3.4 earliest → < 3.4.24 3.4.24

Other CVEs of My Calendar

The 2 CVEs of My Calendar →
CVE-2021-24927 The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup… Not rated
Track this CVE