Timely All-in-One Events Calendar, 7bc5b9f9bd90a552fab6fa68cd3846b7a17b79b1

CVE, Research URL: 7bc5b9f9bd90a552fab6fa68cd3846b7a17b79b1
Home page URL: Security reports for Timely All-in-One Events Calendar
Application: Timely All-in-One Events Calendar
Published on: Apr 11, 2012
Research Description: Timely All-in-One Events Calendar [all-in-one-event-calendar] < 1.5 (closed) WordPress All-in-One Event Calendar Plugin 1.4 - "button_value" Parameter XSS WordPress All-in-One Event Calendar plugin's/wp-content/plugins/all-in-one-event-calendar/app/view/box_publish_button.php "button_value" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication credentials. Other attacks are also possible. Update the plugin.
Affected versions: max 1.5.
Status: vulnerable