CVE-2021-34667 MEDIUM

CVE-2021-34667: Calendar_plugin <= 1.0 Reflected Cross-Site Scripting

Vendor Calendar_Plugin

Product Calendar_plugin

Weakness CWE-79 · XSS

Published August 16, 2021

Last update May 5, 2025

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.

Key dates

02Disclosure timeline

August 16, 2021 CVE published

May 5, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-34667 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-54893 A user with elevated privileges can inject XSS in the Hosts templates configuration page CVE-2024-30433 WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability CVE-2023-50376 WordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS) CVE-2025-31568 WordPress LeadLab by wiredminds plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability CVE-2025-11278 AllStarLink Supermon AllMon2 cross site scripting