Stored Cross-Site Scripting Vulnerability in The Events Calendar Plugin for WordPress

CVE-2024-12118

What is CVE-2024-12118?

The Events Calendar plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access or higher to exploit the Event Calendar Link Widget. This vulnerability arises from inadequate input sanitization and output escaping in the html_tag attribute. By exploiting this flaw, attackers can inject arbitrary web scripts, which are executed when users access the infected pages, potentially compromising user data and site integrity.

References