Unknown My Calendar vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown My Calendar, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4CVE-2021-24927my_calendar_projectmy_calendar+2
EPSS score
0.62%
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue5.4CVE-2024-1274joedolsonmy_calendar+2
EPSS score
0.43%
The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)