CVE-2021-24498

MEDIUMNuclei

Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24498 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.

Description

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 8, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Curated repository PoCs
2
Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Calendar Event Multi View

CVE List1.4.01 to < 1.4.01affected

calendar_event_multi_view

Browse dwbooster / calendar_event_multi_view
VulnCheckVersion data not supplied

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2021-24498Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 525 B

GitHub
PoC details
GitHubCVE-2021-24498Curated repository PoCby yubsy112Not analyzed1 file

Python · 525 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Calendar Event Multi View <1.4.01 - Cross-Site ScriptingCVSS 6.1

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php).

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.

Remediation

Update the WordPress Calendar Event Multi View plugin to version 1.4.01 or later to mitigate the vulnerability.

WeaknessesCWE-79
Authorssuman_kar
Template tagscve2021cvexsswordpresswp-pluginwpscandwboostervkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:dwbooster:calendar_event_multi_view:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/3c5a5187-42b3-4f88-9b0e-4fdfa1c39e86 https://nvd.nist.gov/vuln/detail/CVE-2021-24498 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2