Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: theeventscalendar Component: Eventcalendar Clear all filters
TI-2021-07302 CVE-2021-25024 · GHSA-xm26-26vh-5phq

Event Calendar < 1.1.51 - Reflected Cross-Site Scripting

Priority LOW 29

The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0081 Published 2022-01-17 Fixed in 1.1.51 CWE-79
TI-2021-07303 CVE-2021-25025 · GHSA-96vj-582q-cvqw

Event Calendar < 1.1.51 - Subscriber+ Event Creation

Priority LOW 20

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00347 Published 2022-01-17 Fixed in 1.1.51 CWE-352