Description
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MF Gig Calendar | < 1.2 | 1.2 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting http/cves/2021/CVE-2021-24510.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/715721b0-13a1-413a-864d-2380f38ecd39 exploit vdb-entry technical-description