CVE-2024-58355
High
Description
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.
SeverityHigh
CVSS8.9
Exploit probability—
ProductCalcom Cal.diy
PublishedJul 23, 2026
First seenJul 23, 2026
Weakness typeCWE-80CWE-80
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| calcom cal.diy | v ≤ 4.7.15 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.