CVE-2021-24510
MEDIUM NUCLEIMF Gig Calendar < 1.1 - Reflected Cross-Site Scripting via id GET Parameter
Title source: llmExploitation Summary
CVE-2021-24510 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
Nuclei Templates (1)
WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting
MEDIUMby dhiyaneshDK
References (1)
Core 1
Core References
Third Party Advisory exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/715721b0-13a1-413a-864d-2380f38ecd39
Scores
CVSS v3
6.1
EPSS
0.0231
EPSS Percentile
81.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
Status
published
Products (1)
mf_gig_calendar_project/mf_gig_calendar
< 1.1
Published
Sep 13, 2021
Tracked Since
Feb 18, 2026