CVE-2024-33950

Administrator Cross Site Scripting XSS in Archives Calendar Widget = 1.0.15 versions...

The Events Calendar < 6.4.0.1 - Reflected XSS

Description The plugin does not properly sanitize user-submitted content when rendering some views via AJAX. The Events Calendar "...

CVE-2024-4448: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all versions up to, and including, 5.9.1...

CVE-2024-33950: Improper Neutralization of Input During Web Page Generation

Administrator Cross Site Scripting XSS in Archives Calendar Widget = 1.0.15 versions...

WordPress plugin Archives Calendar Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-4448 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all versions up to, and including, 5.9.1...

PT-2024-31162

Name of the Vulnerable Software and Affected Versions The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.19 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', and 'Advanced Data Table'...

WordPress MF Gig Calendar plugin <= 1.2.1 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin MF Gig Calendar versions = 1.2.1...

CVE-2024-3755

The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3756

The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack...

CVE-2024-3755

The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3756 MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF

The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack...

CVE-2024-3755

The MF Gig Calendar WordPress plugin, affecting versions 1.2.1 and earlier , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitize and escape certain plugin settings. This allows high-privilege users, such as editors , to perform XSS attac...

WordPress plugin MF Gig Calendar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software MF Gig Calendar Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3755 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7e70a0913ed9 Credits Bob Matyas Required...

PT-2024-27647 · WordPress · Mf Gig Calendar

Name of the Vulnerable Software and Affected Versions: MF Gig Calendar WordPress plugin versions 1.2.1 and earlier Description: The issue allows high privilege users, such as editors, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for examp...

PT-2024-27658 · WordPress · Mf Gig Calendar

Name of the Vulnerable Software and Affected Versions: MF Gig Calendar WordPress plugin versions 1.2.1 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in Contributors and above delete arbitrary events via a CSRF...

WordPress plugin MF Gig Calendar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-3756: Cross-Site Request Forgery (CSRF)

The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack...

CVE-2024-3755: Improper Neutralization of Input During Web Page Generation

The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...