TI-2024-30374 Aliases CVE-2024-45303

Discourse Calendar plugin event names susceptible to XSS

LOW 27CWE-79Published 2024-09-12 · Updated 2024-09-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00256 17th percentileScored 2026-11-07

Fix Fixed discourse-calendar (discourse): 0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
discourse	discourse-calendar	before 0.5	0.5	Patch available	CNA

discourse-calendar Vendordiscourse Affected before 0.5 Fixed in 0.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:discourse:calendar::::::::	before 0.5	Vulnerable	discourse

cpe:2.3:a:discourse:calendar:*:*:*:*:*:*:*:* Versions before 0.5 Vulnerable ·discourse

Remediation

Fix · CNA discourse-calendar (discourse) Fixed in 0.5

Timeline

2026-10-02 Threatist record created from CVE-2024-45303

References

Patch 1

https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685c

Advisory 1

https://github.com/discourse/discourse-calendar/security/advisories/GHSA-rq37-8pf3-4xc8

TI-2024-17235 Uninvited user is able to join and mark the attendance of the the private event CVSS 3.1MEDIUM 6.5
TI-2022-20254 Discourse-calendar exposes members of hidden groups CVSS 3.1MEDIUM 5.4
TI-2024-16334 User can see invitees in events created in PMs and private categories CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences