Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Spiffy Plugins Component: Spiffy Calendar Clear all filters
TI-2024-30500 CVE-2024-45457 · GHSA-rwqg-xwvm-5mmj

WordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-09-15 No fix listed CWE-79
TI-2024-30501 CVE-2024-45458 · GHSA-f5ww-mg69-335r

WordPress Spiffy Calendar plugin <= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a throu…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00308 Published 2024-09-15 No fix listed CWE-79
TI-2024-25926 CVE-2024-38692 · GHSA-p92v-rqwc-9j4p

WordPress spiffy-calendar plugin <= 4.9.11 - SQL Injection vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00717 Published 2024-07-22 No fix listed CWE-89
TI-2024-20153 CVE-2024-30427 · GHSA-93v4-m245-8mrg

WordPress Spiffy Calendar plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through 4.9.7.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00414 Published 2024-03-29 No fix listed CWE-79
TI-2024-00789 CVE-2024-0855 · GHSA-g77v-mcj9-92j3

Spiffy Calendar < 4.9.9 - Broken Access Control

Priority MEDIUM 63

The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contribut…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00482 Published 2024-02-27 Fixed in 4.9.9
TI-2023-27155 CVE-2023-49745 · GHSA-r3fh-j377-xjg6

WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00409 Published 2023-12-14 No fix listed CWE-79
TI-2022-23203 CVE-2022-46859 · GHSA-8g6j-479w-669q

WordPress Spiffy Calendar Plugin <= 4.9.1 is vulnerable to SQL Injection

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a throu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00685 Published 2023-11-03 No fix listed CWE-89