Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244

This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacke...

Malicious Package

Overview fullcalendar-windos is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in fullcalendar-windos

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-15883 Malicious code in fullcalendar-windos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 942f89203237b7bb1f918d607864784dc6337b97df3fb598dda116c2b04e2370 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fullcalendar-windos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 942f89203237b7bb1f918d607864784dc6337b97df3fb598dda116c2b04e2370 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-6286: Improper Neutralization of Input During Web Page Generation

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-22351

Missing Authorization vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through = 1.6...

CVE-2026-22351

Missing Authorization vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through = 1.6...

CVE-2026-22351

CVE-2026-22351 pertains to WP FullCalendar (WordPress plugin) versions through 1.6, with a Missing Authorization vulnerability that permits exploitation due to incorrectly configured access control. Red Hat/RedHat and PatchStack mirrors confirm the underlying issue as Broken Access Control affect...

CVE-2026-22351 WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through = 1.6...

CVE-2026-22351

Missing Authorization vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through = 1.6...

CVE-2026-22351 WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through = 1.6...

CVE-2026-22351: Missing Authorization

Missing Authorization vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through = 1.6...

WordPress plugin WP FullCalendar has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-21199

Name of the Vulnerable Software and Affected Versions WP FullCalendar versions through 1.6 Description The WP FullCalendar software contains a missing authorization flaw. This allows exploitation of incorrectly configured access control security levels. No information is available regarding the...

WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Doan Dinh Van in WordPress Plugin WP FullCalendar versions = 1.6...

WordPress Plugin WP FullCalendar Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin WP FullCalendar, which...

WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin WP FullCalendar versions = 1.6...

CVE-2026-24523

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through = 1.6...

CVE-2026-24523

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through = 1.6...