CVE-2021-24553

EUVD-2021-11465
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
timeline_calendar_projecttimeline_calendar
𝑥
≤ 1.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://codevigilant.com/disclosure/2021/wp-plugin-timeline-calendar/
https://wpscan.com/vulnerability/14c75a00-a52b-430b-92da-5145e5aee30a
https://codevigilant.com/disclosure/2021/wp-plugin-timeline-calendar/
https://wpscan.com/vulnerability/14c75a00-a52b-430b-92da-5145e5aee30a