Vulnerabilities

TI-2023-09612 CVE-2023-23813 · GHSA-9592-hvgj-rx9f

WordPress My Calendar Plugin <= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.4.3 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-05-22 No fix listed CWE-352

TI-2022-23504 CVE-2022-47427 · GHSA-37fw-gh9c-pf7v

WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.3.24.1 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00269 Published 2023-03-15 No fix listed CWE-352

TI-2021-07207 CVE-2021-24927 · GHSA-gcvg-gpgp-f6cf

My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting

LOW 25

The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leadin…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0062 Published 2021-11-29 Fixed in 3.2.18 CWE-79

TI-2019-11795 CVE-2019-15713 · GHSA-ppfr-3r6v-m4rm

The my-calendar plugin before 3.1.10 for WordPress has XSS.

LOW 31

The my-calendar plugin before 3.1.10 for WordPress has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02182 Published 2019-08-28 No fix listed CWE-79

Vulnerabilities

Filters

WordPress My Calendar Plugin <= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting

The my-calendar plugin before 3.1.10 for WordPress has XSS.