Threat Entry Updated 2024-11-21

CVE-2021-25024 - Eventcalendar Plugin

The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues

PLUGIN Eventcalendar

CVE-2021-25024

MEDIUM CVSS 6.1 2022-01-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-25025 - Eventcalendar Plugin

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

PLUGIN Eventcalendar

CVE-2021-25025

MEDIUM CVSS 4.3 2022-01-17

Risk Score

Open Full Technical Breakdown