CVE-2021-25083

The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting

Affected products

Events Calendar

Roundupwp Registrations For The Events Calendar

≤ 2.7.10

Fix

Available

CVSS 3.1

6.1 MEDIUM

EPSS

0.9% (57th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2022-01-24