CVE:CVE-2021-25083
CNNVD:CNNVD-202201-2236
WordPress plugin是WordPress开源的一个应用插件。
WordPress plugin 存在跨站脚本漏洞，该漏洞源于 The Registrations for the Events Calendar 插件的注册在将 qtype 参数输出回设置页面的属性之前不会转义它，从而导致反射跨站点脚本。
solution:Upgrade roundupwp registrations_for_the_events_calendar to a higher version than 2.7.10,and avoid the version (,2.7.10]