MEDIUM
Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS
Published Aug 16, 2022
4.3
MEDIUMCVSS 3.1
EPSS 2.65%
Description
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.
Affected products
- Vendor n/a Product Calendar Event Multi View Defaultn/a
- Version 1.4.07StatusaffectedConstraints<1.4.07
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Calendar Event Multi View | n/a |
|
- < 1.4.07
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (3)
- http://packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35080 Advisory
- https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c ExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html | ||
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35080 | Advisory | |
| https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c | ExploitThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Aug 16, 2022
Updated Apr 15, 2025
Reserved Aug 16, 2022
Link CVE-2022-2846
CISA Vulnrichment
Updated Apr 15, 2025
ENISA EUVD
EUVD-2022-35080 Assigner VulDB
Published Aug 16, 2022
Updated Apr 15, 2025
Exploited since n/a
Link EUVD-2022-35080