CVE-2024-0855

The Spiffy Calendar WordPress plugin, in versions prior to 4.9.9 , contains a Broken Access Control vulnerability. The root cause is a failure to validate the event_author parameter, which allows any user to modify this field when creating an event. This can be used to deceive users or administra...

CVE-2024-30427

The Spiffy Calendar WordPress plugin (versions through 4.9.7 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) issue caused by the improper neutralization of input during web page generation. This vulnerability allows unauthenticated attackers to inject malicious scripts into web pages. T...

CVE-2024-45458

CVE-2024-45458 affects Spiffy Calendar plugin for WordPress (versions

CVE-2024-38692

CVE-2024-38692 (Spiffy Calendar) : A SQL Injection in the Spiffy Calendar plugin (WordPress) exists due to improper neutralization of SQL elements. Affected versions are up to 4.9.11, with the injection exploitable in an authenticated context (Administrator+). The CVE entry is linked to WordPress...

CVE-2023-49745

Product/Component: WordPress Spiffy Calendar pluginVulnerability: Stored Cross-Site Scripting (XSS) due to improper input sanitization/escaping in shortcode attributesAffects: Spiffy Calendar versions

CVE-2024-45457

CVE-2024-45457 affects Spiffy Calendar plugin for WordPress (versions through 4.9.13). The vulnerability is a Stored XSS due to improper input neutralization during web page generation. Public records from Patchstack and Red Hat confirm this, listing the affected range as up to 4.9.13 and noting ...

CVE-2024-30528

CVE-2024-30528 is a Missing Authorization (Broken Access Control) vulnerability in Spiffy Calendar (Spiffy Plugins) affecting Spiffy Calendar versions up to 4.9.10. Exploitation would require network access with low privileges and no user interaction; the CVSS base metrics indicate Confidentialit...