WordPress Plugin Vulnerabilities

Spiffy Calendar < 4.9.4 - Reflected XSS

Description

The plugin does not sanitise and escape the page parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin granted they can trick them to press combination of key due to the injection being in an attribute of a hidden field

Affects Plugins

Plugin icon
spiffy-calendar
Fixed in 4.9.4

References

CVE
CVE-2023-32122

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
LEE SE HYOUNG
Verified
Yes
WPVDB ID
66c8659d-c39e-4b26-879a-fa6a7bb341f2

Timeline

Publicly Published
2023-05-03 (about 3 years ago)
Added
2023-08-21 (about 2 years ago)
Last Updated
2023-08-21 (about 2 years ago)

Other

Published
Title
Published
2023-11-06
Title
SendPress Newsletters < 1.23.11.6 - Contributor+ Stored XSS
Published
2026-03-06
Title
MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-11-19
Title
Elementor Portfolio Builder <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-11-15
Title
Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting
Published
2021-09-13
Title
Avada < 7.4.2 - Reflected Cross-Site Scripting