CVE-2021-24341: 
WordPress vulnerability analysis and mitigation

CVE-2021-24341 is a SQL injection vulnerability discovered in the Xllentech English Islamic Calendar WordPress plugin versions before 2.6.8. The vulnerability was identified on January 14, 2021, by security researcher Syed Sheeraz Ali of Codevigilant. The issue affects the date deletion functionality in the plugin (WPScan).

The vulnerability occurs when deleting a date in the plugin, where the yearnumber and monthnumber POST parameters are not properly sanitized, escaped, or validated before being used in SQL statements. This security flaw has been classified as CWE-89 and received a CVSS score of 6.7 (medium severity). The vulnerability falls under the OWASP Top 10 category A1: Injection (WPScan).

The SQL injection vulnerability could allow authenticated users to manipulate database queries, potentially leading to unauthorized access to database contents, modification of database data, or execution of administrative operations on the database (WPScan).

The vulnerability has been fixed in version 2.6.8 of the Xllentech English Islamic Calendar plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).