CVE-2021-24604

MEDIO 4.8CVE-2021-24604 · Published 20/09/2021 · updated 17/06/2026

In breve

CVE-2021-24604 è una vulnerabilità MEDIO (CVSS 4.8) che riguarda availability calendar (offshorewebmaster).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.62%, superiore al 49.8% delle vulnerabilità.
Correzione: aggiornare a 1.2.2 o successiva.

Package	Affected versions	Patched versions
availability calendar offshorewebmaster	`< 1.2.2`	`1.2.2`

Description

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

References

wpscan.com/vulnerability/d084c5b1-45f1-4e7e-b3e9-3c98ae4bce9c · Exploit

Altre vulnerabilità di availability calendar

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free