CVE-2026-1310: Missing Authorization

The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the migaajaxeditorcaldelete function that is hooked to the migaeditorcaldelete AJAX action with both authenticated...

CVE-2025-46249

Cross-Site Request Forgery CSRF vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through = 1.6.4...

CVE-2025-46249

CVE-2025-46249 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simple calendar for Elementor (affected versions: up to 1.6.4). The NVD entry lists a high base CVSSv3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Patch/mitigation guidance across connected sourc...