CVE-2020-23762

low-risk

Published 2021-04-09

Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbitrary web script via the "titel" column on the "Eintrage hinzufugen" tab.

Do I need to act?

0.12% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Larsens Calendar

Affected Vendors

Larsens Calendar Project

References (4)

Exploit http://hidden-one.co.in/2021/04/09/cve-2020-23762-stored-xss-vulnerability-in-th...

Product https://wordpress.org/plugins/larsens-calender/

Exploit http://hidden-one.co.in/2021/04/09/cve-2020-23762-stored-xss-vulnerability-in-th...

Product https://wordpress.org/plugins/larsens-calender/

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal