CVE-2021-25025

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the addcalendarevent AJAX actions, allowing users with a role as low as subscriber to create events...

CVE-2021-25025

CVE-2021-25025 affects the WordPress EventCalendar plugin before 1.1.51. The root cause is insufficient authorization and CSRF checks in the add_calendar_event AJAX actions, enabling a user with a role as low as subscriber to create events. Impact is unauthorized event creation without proper pri...