CVE-2024-1274: 
WordPress vulnerability analysis and mitigation

The My Calendar WordPress plugin versions before 3.4.24 contains a Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and publicly disclosed on March 7, 2024, affecting users with roles as low as Subscriber who have permissions to add events (WPScan).

The vulnerability stems from improper sanitization and escaping of certain parameters in the plugin. The issue specifically affects the Excerpt field and Registration Information field when adding new events. The vulnerability has been assigned a CVSS score of 4.3 (medium severity) and is classified as CWE-79: Cross-Site Scripting (WPScan).

This vulnerability could allow authenticated users with event creation permissions to perform Cross-Site Scripting attacks. The impact depends on the permissions set by the administrator, but it potentially affects both the admin dashboard when editing events and the front-end display of events (WPScan).

The vulnerability can be exploited by users with sufficient permissions to add events. A proof of concept exists where an attacker can insert malicious JavaScript code in the Excerpt field and Registration Information field, which gets executed when the event is edited by an admin or viewed on the front end (WPScan).

The vulnerability has been fixed in version 3.4.24 of the My Calendar plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).