2 lines
3.8 KiB
JSON
2 lines
3.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"My Calendar – Accessible Event Manager","vendor":"joedolson","versions":[{"lessThanOrEqual":"3.7.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template` attribute of the `[my_calendar_upcoming]` shortcode in all versions up to, and including, 3.7.3. This is due to the use of `stripcslashes()` on user-supplied shortcode attribute values in the `mc_draw_template()` function, which decodes C-style hex escape sequences (e.g., `\\x3c` to `<`) at render time, bypassing WordPress's `wp_kses_post()` content sanitization that runs at save time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."},{"lang":"es","value":"El plugin My Calendar – Accessible Event Manager para WordPress es vulnerable a ataques de tipo Stored Cross-Site Scripting a través del atributo «template» del shortcode «[my_calendar_upcoming]» en todas las versiones hasta la 3.7.3, incluida esta. Esto se debe al uso de «stripcslashes()» en los valores de los atributos de los códigos cortos proporcionados por el usuario en la función «mc_draw_template()», que decodifica las secuencias de escape hexadecimales de estilo C (por ejemplo, «\\x3c» a «<») en el momento de la representación, eludiendo la sanitización de contenido «wp_kses_post()» de WordPress que se ejecuta en el momento del guardado. Esto permite a los atacantes autenticados, con acceso de nivel colaborador o superior, inyectar scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada."}],"id":"CVE-2026-2355","lastModified":"2026-06-17T10:30:49.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2355","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-04T15:01:10.759696Z","version":"2.0.3"}}]},"published":"2026-03-04T12:16:03.023","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.2/my-calendar-shortcodes.php#L112"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.2/my-calendar-templates.php#L83"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-shortcodes.php#L112"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-templates.php#L83"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464603%40my-calendar%2Ftrunk&old=3454989%40my-calendar%2Ftrunk&sfp_email=&sfph_mail=#file6"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d5c82e-f82f-4156-bb3e-e6eb365a6c36?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Secondary"}]}
|