WordPress Plugin Vulnerabilities

XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting

Description

The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
xo-event-calendar
Fixed in 2.3.7

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
92562c6c-94a4-427d-97dc-7f5ffddcb6d8

Timeline

Publicly Published
2021-09-01 (about 4 years ago)
Added
2021-09-01 (about 4 years ago)
Last Updated
2021-09-01 (about 4 years ago)

Other

Published
Title
Published
2021-08-02
Title
Email Encoder < 2.1.2 - Reflected Cross Site Scripting
Published
2020-08-10
Title
Admin Menu <= 1.1 - Authenticated Cross-Site Scripting (XSS)
Published
2024-04-04
Title
Happy Addons for Elementor < 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag
Published
2021-07-28
Title
Poll Maker < 3.2.9 - Reflected Cross-Site Scripting
Published
2023-06-08
Title
FiboSearch - AJAX Search for WooCommerce < 1.24.0 - Admin+ Stored Cross-Site Scripting