CVE-2025-48231

CVE-2025-48231 concerns a Stored XSS in the WordPress plugin Booking Calendar Contact Form (versions up to 1.2.58). The issue arises from improper input handling during web page generation. Affected: Booking Calendar Contact Form plugin (

PT-2025-27916 · Codepeople · Codepeople Booking Calendar Contact Form

Name of the Vulnerable Software and Affected Versions: codepeople Booking Calendar Contact Form versions 1.2.58 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means tha...

WordPress plugin Booking Calendar Contact Form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

CVE-2025-48231: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through = 1.2.58...

CVE-2025-0885

Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow unauthorized access to calendar items marked private. This issue affects GroupWise versions 7 through 17.5, 23.4, 24.1, 24.2, 24.3,...

CVE-2025-0885

CVE-2025-0885 describes an Incorrect Authorization vulnerability in OpenText GroupWise where misconfigured access control could allow unauthorized access to private calendar items. Affected versions include 7–17.5 , 23.4 , and 24.1–24.4 . The issue’s root cause is improper authorization logic lea...

CVE-2025-0885 Incorrect Authorization vulnerability affects OpenText™ GroupWise

Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow unauthorized access to calendar items marked private. This issue affects GroupWise versions 7 through 17.5, 23.4, 24.1, 24.2, 24.3,...

PT-2025-27768 · Opentext · Opentext Groupwise

Name of the Vulnerable Software and Affected Versions: OpenText GroupWise versions 7 through 17.5 OpenText GroupWise version 23.4 OpenText GroupWise version 24.1 OpenText GroupWise version 24.2 OpenText GroupWise version 24.3 OpenText GroupWise version 24.4 Description: The issue is related to an...

CVE-2025-0885: Incorrect Authorization

Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow unauthorized access to calendar items marked private. This issue affects GroupWise versions 7 through 17.5, 23.4, 24.1, 24.2, 24.3,...

Malicious code in cvent-event-calendar (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf244badb700ac9a553a78bc1d00ae8c96e4b9b465c79c5bf09374eb9ef768d3 Any computer that has this package installed or running should be considered...

MAL-2025-5387 Malicious code in cvent-event-calendar (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf244badb700ac9a553a78bc1d00ae8c96e4b9b465c79c5bf09374eb9ef768d3 Any computer that has this package installed or running should be considered...

CVE-2025-5936

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a...

CVE-2025-5936

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a...

CVE-2025-5936

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a...

CVE-2025-5936 VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a...

CVE-2025-5936

CVE-2025-5936 documents a Cross-Site Forgery vulnerability in the WordPress VR Calendar plugin. Affected versions are all up to and including 2.4.7, where missing or incorrect nonce validation in the syncCalendar() function allows unauthenticated attackers to trigger a calendar sync via a forged ...

CVE-2025-5936 VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a...

PT-2025-27065 · WordPress · Vr Calendar

Name of the Vulnerable Software and Affected Versions: VR Calendar plugin for WordPress versions prior to 2.4.8 Description: The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for...

WordPress plugin VR Calendar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-5936: Cross-Site Request Forgery (CSRF)

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a...