CVE-2021-24225

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p51

Published

Apr 12, 2021 (Apr 12, 2021)

Modified

Jun 17, 2026

Description

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue

Vendors: elbtide
Products: advanced booking calendar
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.