Description
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | SpiderCalendar | 1.5.65 – ≤ 1.5.65 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting http/cves/2022/CVE-2022-0212.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.