Cross-Site Scripting in The Holiday Calendar Plugin for WordPress
CVE-2015-9270

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Holiday Calendar
Vendor
CVE Published:
1 October 2018

What is CVE-2015-9270?

The Holiday Calendar plugin for WordPress contains a vulnerability that allows for cross-site scripting (XSS) through manipulation of the thc-month parameter. This security flaw could be exploited by an attacker to inject malicious scripts, potentially compromising the security of the affected website and its users. It is crucial for users of the plugin to update to version 1.11.3 or later to mitigate this risk.

References

https://wordpress.org/plugins/the-holiday-calendar/#devel...
x_refsource_MISC
https://seclists.org/fulldisclosure/2015/Jul/125
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.