CVE-2023-6360

The CVE-2023-6360 entry refers to the WordPress My Calendar plugin, affected versions before 3.4.22, with an unauthenticated SQL injection in the from and to parameters of the /my-calendar/v1/events REST route. The vulnerability can enable arbitrary SQL queries against the database and is categor...

CVE-2024-1274

The My Calendar WordPress plugin is vulnerable to Cross-Site Scripting (XSS) in versions prior to 3.4.24 . The root cause is the failure to sanitize and escape certain parameters, which allows users with privileges as low as Subscriber to perform XSS attacks, depending on administrative permissio...