My Calendar, 0c2298fe4231edc362acf8a023a81f0b9a3c411c

CVE, Research URL: 0c2298fe4231edc362acf8a023a81f0b9a3c411c
Home page URL: Security reports for My Calendar
Application: My Calendar
Published on: May 15, 2015
Research Description: My Calendar – Accessible Event Manager [my-calendar] < 2.3.30 My Calendar < 2.3.30 - Reflected Cross-Site Scripting The My Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘value’ parameter in versions before 2.3.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 2.3.30.
Status: vulnerable