The Holiday Calendar Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mva7 The Holiday Calendar allows Stored XSS. This issue affects The Holiday Calendar: from n/a through 1.18.2.1.

Affected:

up to 1.18.2.1

Fix:

No patched version reported

Disclosed:

Jun 6, 2025

CVE-2025-29003 on NVD →

The The Holiday Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.18.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

Affected:

up to 1.18.2.1

Fix:

No patched version reported

Disclosed:

Jun 5, 2025

CVE-2025-29003 on NVD →

[en] XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.

Affected:

up to 1.11.3

Fixed in:

1.11.3

Disclosed:

Oct 1, 2018

CVE-2015-9270 on NVD →

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 1.11.3

Fixed in:

1.11.3

Disclosed:

Aug 10, 2015

XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.

CVSS:

6.1

Affected:

up to 1.11.3

Fixed in:

1.11.3

Disclosed:

Jul 29, 2015

CVE-2015-9270 on NVD →