Medium severity6.5NVD Advisory· Published Jun 14, 2022· Updated Jun 17, 2026
CVE-2022-31059
CVE-2022-31059
Description
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:discourse:discourse_calendar:*:*:*:*:*:discourse:*:*+ 2 more
- cpe:2.3:a:discourse:discourse_calendar:*:*:*:*:*:discourse:*:*range: <1.0.1
- (no CPE)range: <1.0.1
- (no CPE)range: < 1.0.1
- Range: <1.0.1
Patches
Vulnerability mechanics
References
3- github.com/discourse/discourse-calendar/commit/2719b9e81994e961bf8c4e12b4556dc9777dd62fnvdPatchThird Party Advisory
- github.com/discourse/discourse-calendar/pull/280nvdIssue TrackingPatchThird Party Advisory
- github.com/discourse/discourse-calendar/security/advisories/GHSA-c783-x9vm-xxp5nvdThird Party Advisory
News mentions
0No linked articles in our index yet.