Vulnerabilities

TI-2025-05362 CVE-2025-5936 · GHSA-9q8v-c23h-g8fq

VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync

LOW 19

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00138 Published 2025-06-27 No fix listed CWE-352

TI-2022-03531 CVE-2022-3852 · GHSA-g34g-w2hh-7ghj

MEDIUM 41

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00619 Published 2022-11-03 No fix listed CWE-352

TI-2022-02137 CVE-2022-2314 · GHSA-g5j5-w5x8-9mpq

MEDIUM 59

The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17152 Published 2022-08-15 Fixed in 2.3.2 CWE-78