Vulnerabilities

TI-2024-08069 CVE-2024-8700 · GHSA-x468-pj97-v469

Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion

HIGH 72

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00473 Published 2025-05-15 No fix listed

TI-2022-16729 CVE-2022-36390 · GHSA-qfvq-h39h-4m98

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

LOW 25

Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00559 Published 2022-09-21 No fix listed CWE-79

TI-2022-17781 CVE-2022-38067

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability

LOW 36

Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00672 Published 2022-09-09 No fix listed CWE-264

Vulnerabilities

Filters

Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability