WordPress Plugin Vulnerabilities

Calendar_plugin <= 1.0 - Reflected Cross-Site Scripting

Description

The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/calendar.php file which allows attackers to inject arbitrary web scripts

Affects Plugins

Plugin icon
calendar-plugin
No known fix

References

CVE
CVE-2021-34667
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34667

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
p7e4
Verified
No
WPVDB ID
40e4a767-1744-4d51-9d4e-a50fecac6c69

Timeline

Publicly Published
2021-08-13 (about 4 years ago)
Added
2021-08-13 (about 4 years ago)
Last Updated
2022-04-12 (about 4 years ago)

Other

Published
Title
Published
2010-11-05
Title
Vodpod Video Gallery <= 3.1.7 - Cross-Site Scripting (XSS)
Published
2025-06-27
Title
Omnipress < 1.6.5 - Contributor+ Stored XSS
Published
2022-10-12
Title
5 Anker Connect < 1.2.7 - Reflected Cross-Site Scripting
Published
2021-10-05
Title
Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail
Published
2023-06-26
Title
Lana Shortcodes < 1.2.0 - Contributor+ Stored XSS