CVE-2021-24876: Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-29 · updated 2026-06-17
Weakness: CWE-79

Description

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Affected products

Registrations for the Events Calendar – Event Registration Plugin: before 2.7.5 — fixed in 2.7.5

How to fix

Upgrade to a fixed version: Registrations for the Events Calendar – Event Registration Plugin 2.7.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/e77c2493-993d-418d-9629-a1f07b5a2b6f
https://wpscan.com/vulnerability/e77c2493-993d-418d-9629-a1f07b5a2b6f

Get alerted when CVE-2021-24876 or the next vulnerability affects your stack