Description
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Calendar | < 1.3.18 | 1.3.18 |
References
- https://wpscan.com/vulnerability/b2981b41-b712-43d9-a327-3a376346cec5/ exploit vdb-entry technical-description