CVE-2012-1835

Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

8.95% chance of exploitation in the next 30 days, 95th percentile

Nuclei

medium · CWE-79

Published

2012-08-14

Updated

2024-09-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-1835.yaml

ExploitDB entries (4)

• https://www.exploit-db.com/exploits/37078
• https://www.exploit-db.com/exploits/37077
• https://www.exploit-db.com/exploits/37076
• https://www.exploit-db.com/exploits/37075

References

• CVE Record
• NVD entry

Related

• CVE-2012-1831
• CVE-2012-1858
• CVE-2012-1830
• CVE-2012-1875
• CVE-2012-1823
• CVE-2012-1876