CVE-2024-58355
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
CVSS Score
8.9
EPSS Score
0.0%
EPSS Percentile
0th
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.
| CWE | CWE-80 |
| Vendor | calcom |
| Product | cal.diy |
| Published | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for calcom cal.diy
Be the first to know when new high vulnerabilities affecting calcom cal.diy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
calcom / cal.diy
0 ≤ 4.7.15
References
Credits
🔍 xyzeva