CVE-2018-18872

The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.

Score

CVSS 3.0 5.4 Medium

Status

Modified - cve@mitre.org

Published

2019-05-13

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Calendar (Kieranoshea)

References

• https://wpvulndb.com/vulnerabilities/9141