What’s Vulnerable › Vulnerabilities

CVE-2021-24341: Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-14 · updated 2026-06-17
• Weakness: CWE-89

Description

When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.

Affected products

• Xllentech English Islamic Calendar: before 2.6.8 — fixed in 2.6.8

How to fix

Upgrade to a fixed version: Xllentech English Islamic Calendar 2.6.8. Check the vendor advisory for mitigations.

References

• https://codevigilant.com/disclosure/2021/xllentech-english-islamic-calendar/
• https://wpscan.com/vulnerability/1eba1c73-a19b-4226-afec-d27c48388a04
• https://codevigilant.com/disclosure/2021/xllentech-english-islamic-calendar/
• https://wpscan.com/vulnerability/1eba1c73-a19b-4226-afec-d27c48388a04

Get alerted when CVE-2021-24341 or the next vulnerability affects your stack