WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Affected WordPress components

• WordPress core
  Confirmed match
  Versions not specified
• My Calendar – Accessible Event Manager Plugin · my-calendar
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Versions not specified

References

• plugins.trac.wordpress.org http://plugins.trac.wordpress.org/changeset/490070/my-calendar Exploit, Patch
• secunia.com http://secunia.com/advisories/47579 Vendor Advisory
• wordpress.org http://wordpress.org/extend/plugins/my-calendar/changelog/
• www.securityfocus.com http://www.securityfocus.com/bid/51539
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/72454
• nvd.nist.gov Official NVD record