CVE-2024-10878: Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting
The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10878?
CVE-2024-10878 has a medium severity rating due to the potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-10878?
To fix CVE-2024-10878, update the Sugar Calendar plugin to version 3.3.1 or later, which addresses the vulnerability.
What versions are affected by CVE-2024-10878?
All versions of the Sugar Calendar plugin up to and including 3.3.0 are affected by CVE-2024-10878.
What type of vulnerability is CVE-2024-10878?
CVE-2024-10878 is a reflected cross-site scripting vulnerability, allowing attackers to execute scripts in the context of a user's session.
Who is impacted by CVE-2024-10878?
Users of the Sugar Calendar – Simple Event Management plugin for WordPress are impacted by CVE-2024-10878 if they are running vulnerable versions.