555 matches found
CVE-2022-47427
CVE-2022-47427: WordPress My Calendar plugin
CVE-2022-47427 WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Joseph C Dolson My Calendar plugin = 3.3.24.1 versions...
CVE-2023-24388
Cross-Site Request Forgery CSRF vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin = 3.2.3 versions affects plugin forms actions create, duplicate, edit, delete...
My Calendar < 3.3.25 - Event/Location Deletion via CSRF
The plugin does not have CSRF checks when deleting events and locations, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS
The plugin does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users such as high-privilege ones like admin. PoC 1. Create a new calendar in the plugin's...
CVE-2022-3982
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE...
CVE-2022-3982 Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE...
CVE-2022-45824 WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Advanced Booking Calendar plugin = 1.7.1 on WordPress...
WordPress Booking Calendar Plugin SQL Injection (CVE-2018-20556)
A command execution vulnerability exists in WordPress Plugin Booking Calendar . Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
CVE-2022-3852
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
CVE-2022-3852
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
Cross site request forgery (csrf)
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
CVE-2022-3852 VR Calendar <= 2.3.3 - Cross-Site Request Forgery
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
CVE-2022-3852 VR Calendar <= 2.3.3 - Cross-Site Request Forgery
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...
PT-2022-24166 · WordPress · Events Calendar Plugin
Name of the Vulnerable Software and Affected Versions: Events Calendar Plugin affected versions not specified Description: A vulnerability was found in the Events Calendar Plugin, affecting the file post.php of the component Event Handler. The manipulation of the title and body arguments leads to...
CVE-2022-36390
The CVE-2022-36390 entry concerns the WordPress Totalsoft Event Calendar – Calendar plugin (versions 1.4.6 and earlier). The root cause is an authenticated reflected cross-site scripting (XSS) vulnerability in the plugin’s handling of input, which can affect authenticated users (subscriber+). Pra...
WordPress plugin Event Calendar – Calendar 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
CVE-2022-38067
Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin = 1.4.6 at WordPress...
CVE-2022-38067 WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability
Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin = 1.4.6 at WordPress...