Editorial Calendar < 3.8.3 – Contributor+ Stored XSS | CVE 2022-4115 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.

Proof of Concept

Login as a contributor, go to the Calendar page (https://example.com/wp-admin/edit.php?page=cal), and get the nonce from the edcal.wp_nonce in the source

Make a request like https://example.com/wp-admin/admin-ajax.php?_wpnonce=NONCE&action=edcal_saveoptions&wheel-support=true});</script><script>alert(/XSS/);</script>

The XSS will be triggered for anyone viewing the Calendar page

PS: All options are affected (such as weeks , status-hide, time-hide, etc)

Affects Plugins

editorial-calendar

Fixed in 3.8.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

iohex

Submitter

iohex

Submitter twitter

Verified

Yes

WPVDB ID

2b5071e1-9532-4a6c-9da4-d07932474ca4

Timeline

Publicly Published

2022-06-05 (about 3 years ago)

Added

2023-06-05 (about 2 years ago)

Last Updated

2023-08-14 (about 2 years ago)

Other

Published

Title

Published

2024-12-17

Title

Services updates for customers <= 1.0 - Reflected Cross-Site Scripting

Published

2025-12-22

Title

Calendar < 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc'

Published

2024-06-05

Title

Easy Table of Contents < 2.0.66 - Admin+ Stored XSS

Published

2025-01-16

Title

Marmoset Viewer <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-31

Title

RLM Elementor Widgets Pack < 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting