CVE-2024-3895

The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in wpdp_add_new_datepicker_ajax() across all versions up to 2.1.0. Authenticated attackers with subscriber-level access and above can update arbitrary options that may lead ...

CVE-2024-12468

CVE-2024-12468 — WP Datepicker (WordPress) is a Reflected Cross-Site Scripting vulnerability in the WP Datepicker plugin via the wpdp_get_selected_datepicker parameter. It affects all versions up to 2.1.4 due to insufficient input sanitization and output escaping. The weakness allows unauthentica...

CVE-2024-47321

CVE-2024-47321 affects WordPress WP Datepicker

CVE-2024-44042

CVE-2024-44042 is a stored XSS in the WordPress WP Datepicker plugin (affected versions <= 2.1.1). The available connected sources confirm the issue stems from improper input handling during web page generation, allowing stored XSS when using WP Datepicker up to 2.1.1. Remediation: upgrade to ...