{"id":"CVE-2024-3755","summary":"MF Gig Calendar \u003c= 1.2.1 - Editor+ Stored XSS","details":"The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","aliases":["BIT-wordpress-2024-3755","BIT-wordpress-multisite-2024-3755"],"modified":"2026-10-06T02:31:31.404832417Z","published":"2024-05-06T06:00:01.752Z","database_specific":{"cna_assigner":"WPScan","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3755.json","unresolved_ranges":[{"extracted_events":[{"last_affected":"1.2.1"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"fixed":"1.2.1"}],"source":"DESCRIPTION"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3755.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3755"},{"type":"EVIDENCE","url":"https://wpscan.com/vulnerability/d34caeaf-2ecf-44a2-b308-e940bafd402c/"}],"affected":[{"package":{"name":"mf-gig-calendar","ecosystem":"WordPress:Plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-3755.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}