Nextcloud: Calendar attachments of local files are offered to downloaded

A security vulnerability in calendar attachments of local files was discovered, where users were offered to download the attachments...

WordPress Contact Form 7 Calendar plugin <= 3.0.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin Contact Form 7 Calendar versions = 3.0.1...

CVE-2025-46528

Cross-Site Request Forgery CSRF vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue affects Availability Calendar: from n/a through = 0.2.4...

CVE-2025-46510

Cross-Site Request Forgery CSRF vulnerability in harrysudana Contact Form 7 Calendar cf7-calendar allows Stored XSS.This issue affects Contact Form 7 Calendar: from n/a through = 3.0.1...

CVE-2025-46528 WordPress Availability Calendar plugin <= 0.2.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue affects Availability Calendar: from n/a through = 0.2.4...

CVE-2025-46528 WordPress Availability Calendar <= 0.2.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Steve Availability Calendar allows Stored XSS. This issue affects Availability Calendar: from n/a through 0.2.4...

CVE-2025-46528

CVE-2025-46528 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Availability Calendar plugin, which allows Stored XSS. Affected versions are Availability Calendar up to 0.2.4. The available connected sources confirm the CSRF vector and stored XSS potential but do not p...

CVE-2025-46510 WordPress Contact Form 7 Calendar plugin <= 3.0.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in harrysudana Contact Form 7 Calendar cf7-calendar allows Stored XSS.This issue affects Contact Form 7 Calendar: from n/a through = 3.0.1...

CVE-2025-46510 WordPress Contact Form 7 Calendar plugin <= 3.0.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in harrysudana Contact Form 7 Calendar allows Stored XSS. This issue affects Contact Form 7 Calendar: from n/a through 3.0.1...

CVE-2025-46510

CVE-2025-46510 describes a CSRF to Stored XSS vulnerability in the WordPress plugin Contact Form 7 Calendar (harrysudana) affecting versions up to 3.0.1. The issue enables stored XSS via a CSRF, with CVSS v3.1 base score 7.1 (HIGH). No exploitation status is confirmed in the provided documents. R...

WordPress plugin Contact Form 7 Calendar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

WordPress plugin Availability Calendar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2025-17816 · Unknown · Contact Form 7 Calendar

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Calendar versions 3.0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Contact Form 7 Calendar. Recommendations: For versions 3.0.1 and earlier, update to a...

WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin WordPress Events Calendar Registration & Tickets versions = 2.6.0...

WordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by haudayroi in WordPress Plugin Simple calendar for Elementor versions = 1.6.4...

WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by timomangcut in WordPress Plugin Appointment Booking Calendar versions = 1.3.92...

WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability

CSRF to SQL Injection vulnerability discovered by astra.r3verii in WordPress Plugin Appointment Booking Calendar versions = 1.3.92...

WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Bellevue versions = 4.2.2...

CVE-2025-46249

Cross-Site Request Forgery CSRF vulnerability in Michael Simple calendar for Elementor allows Cross Site Request Forgery. This issue affects Simple calendar for Elementor: from n/a through 1.6.4...

CVE-2025-46249

Cross-Site Request Forgery CSRF vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through = 1.6.4...