Timely All-in-One Events Calendar, 055e28dbfe067929c5c997fe11a477ef6b36c687

CVE, Research URL: 055e28dbfe067929c5c997fe11a477ef6b36c687
Home page URL: Security reports for Timely All-in-One Events Calendar
Application: Timely All-in-One Events Calendar
Published on: May 04, 2019
Research Description: Timely All-in-One Events Calendar [all-in-one-event-calendar] < 2.5.39 (closed) Timely All-in-One Events Calendar <= 2.5.38 - Cross-Site Scripting The Timely All-in-One Events Calendar plugin for WordPress is vulnerable to Cross-Site Scripting via several parameters related to event input in versions up to, and including, 2.5.38 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Affected versions: max 2.5.39.
Status: vulnerable