CVE-2015-10099

CVE-2015-10099 affects CP Appointment Calendar Plugin (WordPress) up to version 1.1.5. The issue is an SQL injection in the dex_process_ready_to_go_appointment function within dex_appointments.php, caused by improper handling of the itemnumber argument. The vulnerability can be triggered remotely...

CVE-2015-10099: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dexprocessreadytogoappointment of the file dexappointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiat...

CVE-2013-10023

A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcalfilterwhere of the file edcal.php. The manipulation of the argument edcalstartDate/edcalendDate leads to sql injection. The attack c...

Sql injection

A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcalfilterwhere of the file edcal.php. The manipulation of the argument edcalstartDate/edcalendDate leads to sql injection. The attack c...

CVE-2013-10023

The CVE-2013-10023 issue affects the WordPress Editorial Calendar Plugin up to version 2.6. The vulnerability is in the edcal_filter_where function in edcal.php, where manipulating the edcal_startDate/edcal_endDate parameters enables an SQL injection. Exploitation can be performed remotely. Upgra...

CVE-2013-10023: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcalfilterwhere of the file edcal.php. The manipulation of the argument edcalstartDate/edcalendDate leads to sql injection. The attack c...

PT-2023-10012 · WordPress · Editorial Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Editorial Calendar Plugin versions up to 2.6 Description: A critical issue has been found in the Editorial Calendar Plugin, affecting the function edcal filter where of the file edcal.php. The manipulation of the arguments edcal startDate and...

CVE-2023-24402

Auth. admin+ Cross-Site Scripting XSS vulnerability in Veribo, Roland Murg WP Booking System – Booking Calendar plugin = 2.0.18 versions...

CVE-2022-47438

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin = 3.2.3 versions...

CVE-2022-45814

Stored Cross-Site Scripting XSS vulnerability in Fabian von Allmen WP Calendar plugin = 1.5.3 versions...

CVE-2022-45814 WordPress WP Calendar Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Stored Cross-Site Scripting XSS vulnerability in Fabian von Allmen WP Calendar plugin = 1.5.3 versions...

CVE-2022-45814

The CVE-2022-45814 entry concerns the Fabian von Allmen WP Calendar plugin for WordPress, with a Stored Cross-Site Scripting (XSS) vulnerability affecting versions prior to or equal to 1.5.3. The issue originates from insufficient sanitisation/escaping of parameters (per WPVulndb and PT Security ...

CVE-2022-47427

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Calendar plugin = 3.3.24.1 versions...

CVE-2022-47427

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Calendar plugin = 3.3.24.1 versions...

CVE-2022-47427

CVE-2022-47427: WordPress My Calendar plugin

CVE-2022-47427 WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Calendar plugin = 3.3.24.1 versions...

CVE-2023-24388

Cross-Site Request Forgery CSRF vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin = 3.2.3 versions affects plugin forms actions create, duplicate, edit, delete...

My Calendar < 3.3.25 - Event/Location Deletion via CSRF

The plugin does not have CSRF checks when deleting events and locations, which could allow attackers to make logged in admins perform such actions via CSRF attacks...

WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS

The plugin does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users such as high-privilege ones like admin. PoC 1. Create a new calendar in the plugin's...

CVE-2022-3982

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE...