CVE-2021-24341: Xllentech English Islamic Calendar

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.

Affected products

• Xllentech English Islamic Calendar: before 2.6.8 (fixed in 2.6.8)

Published 2021-06-14. Last modified 2026-06-17.