PT-2021-3991 · WordPress · Calendar Event Multi View

Iohex · Published 2021-07-02 · Updated 2024-11-11 · CVE-2021-24498

Positive Technologies (AI Summary)

CVSS v2.0

7.0

High

Base vector

AV:N/AC:M/Au:S/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Calendar Event Multi View WordPress plugin versions prior to 1.4.01

Description The issue is related to the lack of protection of the web page structure, allowing a remote attacker to conduct cross-site scripting attacks. Specifically, the start and end GET parameters are not sanitized or escaped before being output in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue.

Recommendations For Calendar Event Multi View WordPress plugin versions prior to 1.4.01, update to version 1.4.01 or later to resolve the issue. As a temporary workaround, consider restricting access to the php/edit.php page until a patch is available. Avoid using the start and end GET parameters in the affected page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04512

CVE-2021-24498

Affected Products

Calendar Event Multi View

References · 7

• 🔥 https://wpscan.com/vulnerability/3c5a5187-42b3-4f88-9b0e-4fdfa1c39e86 · Exploit
• https://bdu.fstec.ru/vul/2021-04512 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-24498 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24498 · Vendor Advisory
• https://t.me/cibsecurity/26653 · Telegram Post
• https://twitter.com/threatintel/status/1855937494715400355 · Twitter Post
• https://t.me/cvenotify/18985 · Telegram Post