CVE-2017-9420

Cross site scripting XSS vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter...

WordPress plugin "Booking Calendar" vulnerable to directory traversal

Overview The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A local file outside of th...

WordPress plugin Booking Calendar plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Booking Calendar plugin version 7.1 and earlier versions, whi...

WordPress Booking Calendar Plugin Directory Traversal Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A directory traversal vulnerability exists in WordPress plugin Booking Calendar plugin version 7.0 and earlier versions, whic...

WordPress Calendar 1.3.7 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting in Calendar WordPress Plugin ------------------------------------------------------------------------ Remco Vermeulen, July 2016 ------------------------------------------------------------------------...

JIRA Mail.ru Calendar 2.4.2.50_JIRA6 Cross Site Scripting

Hello Team, I have identified Stored Cross Site Scripting Vulnerability in JIRA - Mail.ru Calendar Plugin. Overview-----------------------------------------------------------------------------------------------------------------------Vendor: JIRA Vulnerable Product: Mail.ru Calendar Plugin...

WordPress Booking Calendar Contact Form 1.1.24 Plugin - addslashes SQL Injection

Exploit for php platform in category web applications Exploit Title: WordPress appointment-booking-calendar =1.1.24 - SQL injection through ´addslashes´ wordpress ´wpmagicquotes´ function Date: 2016-01-28 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit...

WordPress My Calendar Plugin 2.4.10 CSRF 和 XSS 漏洞

No description provided by source...

WordPress My Calendar Plugin 2.4.10 - Multiple Vulnerabilities

My Calendar plugin is prone to multiple vulnerabilities, such as CSRF and XSS. Solution Update the plugin...

CVE-2015-7319

CVE-2015-7319 affects the WordPress plugin “Appointment Booking Calendar” prior to version 1.1.8. The vulnerability is a SQL injection in cpabc_appointments_admin_int_calendar_list.inc.php that allows remote attackers to execute arbitrary SQL commands via vectors related to updating the username....

CVE-2015-7235

Multiple SQL injection vulnerabilities in dexreservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in a dexreservationscalendarload2 action or 2 dexitem parameter in a...

WordPress The Holiday Calendar Plugin <= 1.11.2 - Cross Site Scripting (XSS)

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress My Calendar Plugin <= 2.3.29 - Multiple Vulnerabilities

This plugin is prone to a reflected XSS and arbitrary file override vulnerabilities. Because of them, attackers can override any existing file that is stored on the server or inject arbitrary JavaScript or HTML. Solution Update this plugin...

My Calendar <= 2.3.29 - Arbitrary File Override & Reflected XSS

The file override vulnerability allows an admin to override any file on the web server, ignoring settings such as DISALLOWFILEEDIT. Arbitrary File Override ----------------------- POST http://localhost/wordpress/wp-admin/admin.php?page=my-calendar-styles Post Data: wpnonceavalidnonce...

My Calendar <= 2.3.28 - Cross-Site Scripting (XSS)

The My Calendar WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

CVE-2014-8586

SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter...

WordPress The Events Calendar Plugin <= 3.0 - Reflected Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

CVE-2014-4571

Multiple cross-site scripting XSS vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 fs or 2 w parameter...

CVE-2014-4571

Summary of CVE-2014-4571 : The VN-Calendar WordPress plugin (vncal.js.php) version 1.0 and earlier is affected. The vulnerability is a Multiple Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML by supplying input via the (1) fs or (2) w parameters...

CVE-2013-2698

Cross-site request forgery CSRF vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors...