CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjunk Calendar Plus calendar-plus allows Reflected XSS.This issue affects Calendar Plus: from n/a through <= 1.2.4.
Explanation of Vulnerability in Simple Terms
Calendar Plus versions up to 1.2.4 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. When a victim visits a crafted link or page, the injected code executes in their browser with their permissions. This can lead to session hijacking, credential theft, or unauthorized actions on the site.
What an attacker can do
Inject and execute malicious JavaScript in a victim's browser to steal session tokens, credentials, or perform actions as that user.
Potential impact on your site
Users visiting crafted URLs could have their sessions compromised or be tricked into performing unwanted actions on your site.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page that triggers the vulnerability. No authentication required.
Key dates
External resources
Related vulnerabilities
