Threats tagged 'ghsa-cphm-r4g7-w5h9'

The CP Multi View Events Calendar plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter. This affects all versions up to and including 1.4.43. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. The exploit requires access to a nonce localized to any published page with the calendar shortcode, making the attack feasible for authenticated users.