CVE-2024-1274

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	My Calendar	< 3.4.24
joedolson	my_calendar	< 3.4.24

References

https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f/Exploit, Third Party Advisory

Timeline

Published: Apr 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-127407.8Vision-related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities CVE-2024-127417.8A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation CVE-2024-127427.8A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution.  Succ CVE-2024-127434.8The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such a CVE-2024-127448.0A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or CVE-2024-127458.0A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, o CVE-2024-127468.0A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables CVE-2024-127475.6A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavi CVE-2024-127497.1The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to CVE-2024-12759.1Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.Th CVE-2024-127504.3The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2024-127517.8Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi