### [CVE-2021-24341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24341)
![](https://img.shields.io/static/v1?label=Product&message=Xllentech%20English%20Islamic%20Calendar&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.6.8%3C%202.6.8%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.

### POC

#### Reference
- https://wpscan.com/vulnerability/1eba1c73-a19b-4226-afec-d27c48388a04

#### Github
No PoCs found on GitHub currently.