PT-2021-16371 · WordPress · My Calendar

Krzysztof Zając · Published 2021-11-29 · Updated 2021-11-29 · CVE-2021-24927

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: My Calendar WordPress plugin versions prior to 3.2.18

Description: The issue arises from the lack of sanitization and escaping of the callback parameter in the mc post lookup AJAX action, which is accessible to any authenticated user. This leads to a Reflected Cross-Site Scripting issue, where an attacker can inject malicious scripts into the response. The mc post lookup AJAX action is the specific endpoint affected by this issue.

Recommendations: For versions prior to 3.2.18, update to version 3.2.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the mc post lookup AJAX action to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24927

Affected Products

My Calendar

References · 5

• 🔥 https://wpscan.com/vulnerability/86f3acc7-8902-4215-bd75-6105d601524e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24927 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24927 · Vendor Advisory
• https://t.me/cvenotify/23867 · Telegram Post
• https://t.me/cibsecurity/33018 · Telegram Post