The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
CPE | Name | Operator | Version |
---|---|---|---|
registrations_for_the_events_calendar | le | 2.7.10 |