CVE-2024-12077

The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendarid’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-12077

CVE-2024-12077 corresponds to a reflected Cross-Site Scripting vulnerability in the Booking Calendar and Booking Calendar Pro WordPress plugins. The issue is triggered via the calendar_id parameter in all versions up to 3.2.19 (Booking Calendar) and 11.2.19 (Booking Calendar Pro), caused by insuf...

CVE-2024-12077 Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'

The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendarid’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it...

PT-2025-1856 · WordPress · Yogo Booking

Name of the Vulnerable Software and Affected Versions: YOGO Booking plugin for WordPress versions up to, and including, 1.6.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the yogo-calenda...

PT-2025-1743

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 3.2.19 Booking Calendar Pro versions prior to 11.2.19 Description The issue concerns a Reflected Cross-Site Scripting vulnerability via the calendar id parameter due to insufficient input sanitization and...

CVE-2024-12462: Improper Neutralization of Input During Web Page Generation

The YOGO Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yogo-calendar' shortcode in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-12077: Improper Neutralization of Input During Web Page Generation

The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendarid’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it...

WordPress plugin Booking Calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-55075

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes...

PT-2025-3094

Name of the Vulnerable Software and Affected Versions Grocy versions prior to 4.3.0 Description The issue allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes. Recommendations For Grocy versions prior to...

CVE-2024-55075

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes...

CVE-2024-38762

Cross-Site Request Forgery CSRF vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: from n/a through = 5.11.0.4...

CVE-2024-37518

Cross-Site Request Forgery CSRF vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through = 6.5.1.4...

CVE-2024-37518 WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in The Events Calendar The Events Calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through 6.5.1.4...

CVE-2024-37518 WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through = 6.5.1.4...

CVE-2024-37518

CVE-2024-37518 is a CSRF vulnerability in The Events Calendar plugin for WordPress, affecting The Events Calendar versions up to 6.5.1.4. The issue is mitigated by upgrading to version 6.5.1.4 or later (the patched release). The connected sources confirm the vulnerability class as Cross-Site Requ...

CVE-2024-37518: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through = 6.5.1.4...

PT-2025-2500

Name of the Vulnerable Software and Affected Versions: The Events Calendar versions through 6.5.1.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker...

WordPress plugin The Events Calendar 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2025-2524 · Unknown · The Events Calendar Event Tickets

Name of the Vulnerable Software and Affected Versions: The Events Calendar Event Tickets versions prior to 5.11.0.4 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue may be exploited to perform actions without the user...