CVE-2012-1835

This exploit demonstrates multiple XSS vulnerabilities in the All-in-One Event Calendar WordPress plugin by injecting malicious JavaScript via unsanitized input parameters. The PoC includes URLs with script tags to execute arbitrary JavaScript in the context of the affected site.

This exploit demonstrates a reflected XSS vulnerability in the All-in-One Event Calendar WordPress plugin by injecting a script tag into the 'msg' parameter of the 'save_successful.php' endpoint. The PoC triggers an alert with the user's cookies, confirming the vulnerability.

This exploit demonstrates a reflected XSS vulnerability in the All-in-One Event Calendar WordPress plugin by injecting a malicious script via the 'title[id]' parameter. The PoC uses a simple alert to display the user's cookies, proving arbitrary JavaScript execution.

This exploit demonstrates a reflected XSS vulnerability in the All-in-One Event Calendar WordPress plugin by injecting arbitrary JavaScript via the 'button_value' parameter. The PoC uses a simple alert to display the user's cookies, proving the lack of input sanitization.