Description
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
References (3)
Core 3
Core References
Third Party Advisory x_refsource_confirm
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-c783-x9vm-xxp5
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/discourse/discourse-calendar/pull/280
Patch, Third Party Advisory x_refsource_misc
https://github.com/discourse/discourse-calendar/commit/2719b9e81994e961bf8c4e12b4556dc9777dd62f
Scores
CVSS v3
6.5
EPSS
0.0033
EPSS Percentile
56.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-79
Status
published
Products (1)
discourse/discourse_calendar
< 1.0.1
Published
Jun 14, 2022
Tracked Since
Feb 18, 2026