CVE-2022-0212
SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 2.3%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
14 Feb 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
Affected products
Unknown · SpiderCalendarWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →