Cross-Site Scripting Vulnerability in Discourse Calendar Plugin

CVE-2024-45303

What is CVE-2024-45303?

The Discourse Calendar plugin enables users to create interactive calendars in discussion topics. However, a vulnerability in versions prior to 0.5 allows attackers to perform Cross-Site Scripting (XSS) attacks through event names if the site's default Content Security Policy (CSP) is modified or disabled. This could lead to unauthorized script execution in the context of a user's session, making it imperative for site administrators to update to the patched version to safeguard against such attacks.

References