CVE-2022-0212: SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-14 · updated 2026-06-17
Weakness: CWE-79

Description

The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.

Affected products

SpiderCalendar: through 1.5.65

References

https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47
https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47

Get alerted when CVE-2022-0212 or the next vulnerability affects your stack