Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

16 records

Vendor: Spiffy Plugins Clear all filters
TI-2025-42044 CVE-2025-68523 · GHSA-j5jw-33rr-98g2

WordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00189 Published 2025-12-24 No fix listed CWE-862
TI-2025-36293 CVE-2025-58625 · GHSA-5874-whf6-vxhm

WordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) Vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.5…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00177 Published 2025-09-03 No fix listed CWE-79
TI-2024-33181 CVE-2024-49695 · GHSA-f37j-hh5v-8qrg

WordPress WP Flow Plus plugin <= 5.2.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.3…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00276 Published 2024-10-24 No fix listed CWE-79
TI-2024-29558 CVE-2024-43969 · GHSA-jq2v-926w-pmg3

WordPress Spiffy Calendar plugin <= 4.9.12 - SQL Injection vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.12.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00418 Published 2024-09-17 No fix listed CWE-89
TI-2024-30500 CVE-2024-45457 · GHSA-rwqg-xwvm-5mmj

WordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-09-15 No fix listed CWE-79
TI-2024-30501 CVE-2024-45458 · GHSA-f5ww-mg69-335r

WordPress Spiffy Calendar plugin <= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a throu…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00308 Published 2024-09-15 No fix listed CWE-79
TI-2024-25926 CVE-2024-38692 · GHSA-p92v-rqwc-9j4p

WordPress spiffy-calendar plugin <= 4.9.11 - SQL Injection vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00717 Published 2024-07-22 No fix listed CWE-89
TI-2024-23520 CVE-2024-35651 · GHSA-g9q9-wh2q-x3pm

WordPress WP Flow Plus plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows Stored XSS.This issue affects WP Flow Plus: from n/a through 5.2.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00254 Published 2024-06-04 No fix listed CWE-79
TI-2024-20153 CVE-2024-30427 · GHSA-93v4-m245-8mrg

WordPress Spiffy Calendar plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through 4.9.7.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00414 Published 2024-03-29 No fix listed CWE-79
TI-2024-00789 CVE-2024-0855 · GHSA-g77v-mcj9-92j3

Spiffy Calendar < 4.9.9 - Broken Access Control

Priority MEDIUM 63

The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contribut…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00482 Published 2024-02-27 Fixed in 4.9.9
TI-2023-27155 CVE-2023-49745 · GHSA-r3fh-j377-xjg6

WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00409 Published 2023-12-14 No fix listed CWE-79
TI-2022-23203 CVE-2022-46859 · GHSA-8g6j-479w-669q

WordPress Spiffy Calendar Plugin <= 4.9.1 is vulnerable to SQL Injection

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a throu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00685 Published 2023-11-03 No fix listed CWE-89