My Calendar <= 2.3.29 - Arbitrary File Override & Reflected XSS

The file override vulnerability allows an admin to override any file on the web server, ignoring settings such as DISALLOWFILEEDIT. Arbitrary File Override ----------------------- POST http://localhost/wordpress/wp-admin/admin.php?page=my-calendar-styles Post Data: wpnonceavalidnonce...

WordPress My Calendar Plugin <= 2.3.29 - Multiple Vulnerabilities

This plugin is prone to a reflected XSS and arbitrary file override vulnerabilities. Because of them, attackers can override any existing file that is stored on the server or inject arbitrary JavaScript or HTML. Solution Update this plugin...

My Calendar <= 2.3.28 - Cross-Site Scripting (XSS)

The My Calendar WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

CVE-2014-8586

SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands via the calid parameter...

WordPress The Events Calendar Plugin <= 3.0 - Reflected Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

CVE-2014-4571

Multiple cross-site scripting XSS vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 fs or 2 w parameter...

CVE-2014-4571

Summary of CVE-2014-4571 : The VN-Calendar WordPress plugin (vncal.js.php) version 1.0 and earlier is affected. The vulnerability is a Multiple Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML by supplying input via the (1) fs or (2) w parameters...

CVE-2013-2698

Cross-site request forgery CSRF vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors...

CVE-2013-2698

The CVE-2013-2698 issue affects the WordPress Calendar plugin, specifically versions before 1.3.3. It is a Cross‑Site Request Forgery (CSRF) vulnerability that allows remote attackers to hijack a user’s authentication to perform calendar-entry additions via unspecified vectors. Impact is user-aut...

CVE-2013-2698

Cross-site request forgery CSRF vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Calendar plugin before 1.3.3 for WordPress allows remote attackers to hijack the authentication of users for requests that add a calendar entry via unspecified vectors...

WordPress Booking System Plugin - SQL Injection

This WordPress Booking Calendar plugin's "bookingformid" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

CVE-2013-1470

Cross-site scripting XSS vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendartype parameter to submit.php...

Cross site scripting

Cross-site scripting XSS vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendartype parameter to submit.php...

CVE-2013-1470

Cross-site scripting XSS vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendartype parameter to submit.php...

CVE-2013-1470: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendartype parameter to submit.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

WordPress My Calendar Plugin <= 1.10.1 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the PATHINFO. Solution Update the plugin...

WordPress Spider Calendar Plugin Multiple SQLi Vulnerabilities

WordPress Spider Calendar Plugin is prone to multiple SQL Injection vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress

Advisory ID: HTB23082 Product: All-in-One Event Calendar Plugin for WordPress Vendor: The Seed Studio Vulnerable Versions: 1.4 and probably prior Tested Version: 1.4 Vendor Notification: 21 March 2012 Public Disclosure: 11 April 2012 Vulnerability Type: Cross-Site Scripting XSS CVE References:...