Calendar event multi view - XSS (CVE-2021-24498)

CVE-2021-24498 is a vulnerability affecting the Calendar Event Multi View WordPress plugin, where improper handling of input allows attackers to inject arbitrary web content via reflected cross-site scripting.

CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2021-24498 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2021-24498 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2021-24498 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Exploitation attempts commonly involve URLs with / that include parameter sequences related to cpmvc_id=1&cpmvc_do_action=mvparse&f=edit, with further manipulation of date-related parameters.