This repository was archived by the owner on Jul 15, 2025. It is now read-only.
Calendar event names susceptible to XSS
Package
Calendar plugin
(Discourse)
Affected versions
<=0.4
Patched versions
>=0.5
Impact
Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy.
Patches
The issue is patched in version
0.5of the Discourse Calendar plugin.Workarounds
Ensure that the setting
content_security_policyis enabled and has not been modified in a way which would make it more vulnerable to XSS attacks.References
Mitigate XSS attacks with Content Security Policy