Calendar event multi view - XSS (CVE-2021-24498)

CVE-2021-24498 is a vulnerability affecting the Calendar Event Multi View WordPress plugin, where improper handling of input allows attackers to inject arbitrary web content via reflected cross-site scripting.

CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-24498 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec network telemetry also shows that exploitation of CVE-2021-24498 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Exploitation attempts commonly involve URLs with / that include parameter sequences related to cpmvc_id=1&cpmvc_do_action=mvparse&f=edit, with further manipulation of date-related parameters.