### [CVE-2024-1274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1274)
![](https://img.shields.io/static/v1?label=Product&message=My%20Calendar&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%203.4.24%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brighgreen)

### Description

The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)

### POC

#### Reference
- https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f/
- https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f/

#### Github
No PoCs found on GitHub currently.