Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: joedolson Component: My Calendar Clear all filters
TI-2024-01186 CVE-2024-1274 · GHSA-9576-cchc-4f79

My Calendar < 3.4.24 - Authenticated Stored XSS

Priority MEDIUM 58

The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00425 Published 2024-04-02 Fixed in 3.4.24 CWE-79
TI-2023-05838 CVE-2023-6360 · GHSA-x23q-f896-mvpf

SQL injection in my-calendar

Priority HIGH 83

The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.63141 Published 2023-11-30 Fixed in 3.4.22 CWE-89