Read the docs
TI-2021-06797 Aliases CVE-2021-24510GHSA-54p3-vvrm-gcf3

MF Gig Calendar < 1.2 - Reflected Cross-Site Scripting (XSS)

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue

Why it matters now

EPSS 0.02819 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed MF Gig Calendar (Unknown): 1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownMF Gig Calendarbefore 1.21.2Patch availableCNA
  • MF Gig Calendar VendorUnknown Affected before 1.2 Fixed in 1.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mf_gig_calendar_project:mf_gig_calendar:*:*:*:*:wordpress:*:*:*up to 1.1VulnerableMatthew Fries
  • cpe:2.3:a:mf_gig_calendar_project:mf_gig_calendar:*:*:*:*:wordpress:*:*:* Versions up to 1.1 Vulnerable ·Matthew Fries

Remediation

  • Fix · CNA MF Gig Calendar (Unknown) Fixed in 1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24510
  2. 2026-10-03 Alias added: GHSA-54p3-vvrm-gcf3

References

Exploit 1

  • TI-2024-03502 MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF CVSS 3.1HIGH 7.5
  • TI-2023-27747 WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to SQL Injection CVSS 3.1HIGH 8.8
  • TI-2024-22235 WordPress MF Gig Calendar plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2012-03623 Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for… CVSS 2.0MEDIUM 4.3
  • TI-2023-19402 WordPress MF Gig Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
  • TI-2024-03501 MF Gig Calendar <= 1.2.1 - Editor+ Stored XSS CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences