Read the docs

Spiffy Plugins

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Spiffy Plugins records in CISA KEV

No Spiffy Plugins vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Spiffy Calendar 11 records MEDIUM Wp Flow Plus 2 records LOW

Records

11 records in Spiffy Calendar · all components

TI-2024-00789 CVE-2024-0855 · GHSA-g77v-mcj9-92j3

Spiffy Calendar < 4.9.9 - Broken Access Control

Priority MEDIUM 63

The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contribut…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00482 Published 2024-02-27 Fixed in 4.9.9
TI-2022-23203 CVE-2022-46859 · GHSA-8g6j-479w-669q

WordPress Spiffy Calendar Plugin <= 4.9.1 is vulnerable to SQL Injection

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a throu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00685 Published 2023-11-03 No fix listed CWE-89
TI-2024-25926 CVE-2024-38692 · GHSA-p92v-rqwc-9j4p

WordPress spiffy-calendar plugin <= 4.9.11 - SQL Injection vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00717 Published 2024-07-22 No fix listed CWE-89
TI-2024-30501 CVE-2024-45458 · GHSA-f5ww-mg69-335r

WordPress Spiffy Calendar plugin <= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a throu…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00308 Published 2024-09-15 No fix listed CWE-79
TI-2023-27155 CVE-2023-49745 · GHSA-r3fh-j377-xjg6

WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00409 Published 2023-12-14 No fix listed CWE-79
TI-2024-30500 CVE-2024-45457 · GHSA-rwqg-xwvm-5mmj

WordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-09-15 No fix listed CWE-79
TI-2024-20153 CVE-2024-30427 · GHSA-93v4-m245-8mrg

WordPress Spiffy Calendar plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through 4.9.7.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00414 Published 2024-03-29 No fix listed CWE-79
Open these records in search →