CVE-2021-24604

PoC —

CVSS 3.1

4.8 medium

EPSS

<1%p48

Published

Sep 20, 2021 (Sep 20, 2021)

Modified

Jun 17, 2026

Description

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Vendors: offshorewebmaster
Products: availability calendar
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.