Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
617 results · page 8 of 13
Dec 9, 2024Booking Calendar Contact Form: Missing AuthorizationCVE-2023-25037 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.
- Product
- Booking Calendar Contact Form
- Affected
- up to 1.2.34
- What to do
- Affects up to 1.2.34. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2023-24407 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024CP Multi View Event Calendar: Missing AuthorizationCVE-2023-23814 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through 1.4.13.
- Product
- CP Multi View Event Calendar
- Affected
- up to 1.4.13
- What to do
- Affects up to 1.4.13. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2024-9872 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_user_data_callback() function in all versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts and update settings.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2024WP Booking Calendar: Does not sanitise and escape some of its settingsCVE-2024-10893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Booking Calendar
- Fixed in
- 10.6.5
- What to do
- Update WP Booking Calendar to 10.6.5 or newer.
Nov 26, 2024Sugar Calendar – Simple Event Management: Reflected Cross-Site ScriptingCVE-2024-10878 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Sugar Calendar – Simple Event Management
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Sugar Calendar – Simple Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 26, 2024Booking calendar, Appointment Booking System: Stored Cross-Site ScriptingCVE-2024-9504 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.15
- What to do
- Affects up to 3.2.15. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhacked.beplugins.trac.wordpress.org
Nov 19, 2024Multi-day Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51873 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masashi Takizawa Multi-day Booking Calendar multi-day-booking-calendar allows DOM-Based XSS.This issue affects Multi-day Booking Calendar: from n/a through <= 1.0.1.
- Product
- Multi-day Booking Calendar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Multi-day Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024Registrations for the Events Calendar: Does not sanitise and escape some parametersCVE-2024-7982 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.12.4
- What to do
- Update Registrations for the Events Calendar to 2.12.4 or newer.
Nov 7, 2024WP Booking Calendar: Does not sanitise and escape some of its Widgets settingsCVE-2024-10027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Booking Calendar
- Fixed in
- 10.6.3
- What to do
- Update WP Booking Calendar to 10.6.3 or newer.
Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Notification settingsCVE-2024-7877 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Fixed in
- 1.6.7.55
- What to do
- Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.
Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Appointment Type settingsCVE-2024-7876 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Fixed in
- 1.6.7.55
- What to do
- Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.
Nov 1, 2024Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: SQL InjectionCVE-2024-10540 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of the bookingpress_form shortcode in all versions up to, and including, 1.1.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
- Affected
- up to 1.1.16
- What to do
- Affects up to 1.1.16. Update Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Registrations for the Events Calendar: Missing AuthorizationCVE-2024-43143 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Roundup WP Registrations for the Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registrations for the Events Calendar: from n/a through 2.12.1.
- Product
- Registrations for the Events Calendar
- Affected
- up to 2.12.1
- What to do
- Affects up to 2.12.1. Update Registrations for the Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024DarkMySite – Advanced Dark Mode Plugin for: Cross-Site Request Forgery (CSRF)CVE-2024-50466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite – Advanced Dark Mode Plugin for WordPress: from n/a through 1.2.8.
- Product
- DarkMySite – Advanced Dark Mode Plugin for
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update DarkMySite – Advanced Dark Mode Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-9865 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the transaction log for a booking.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.4.7
- What to do
- Affects up to 4.0.4.7. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-9864 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when front-end users can submit new events with tickets.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.4.7
- What to do
- Affects up to 4.0.4.7. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 19, 2024EventON PRO - WordPress Virtual Event Calendar: Cross-Site Request ForgeryCVE-2023-6243 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admin_test_email function. This makes it possible for unauthenticated attackers to send test emails to arbitrary email addresses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- EventON PRO - WordPress Virtual Event Calendar
- Affected
- up to 4.6.8
- What to do
- Affects up to 4.6.8. Update EventON PRO - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.myeventon.complugins.trac.wordpress.org
Oct 17, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Account Takeover/Privilege EscalationCVE-2024-9263 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible.
- Product
- WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
- Affected
- up to 1.0.25
- What to do
- Affects up to 1.0.25. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 5, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.4.6.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024VR Calendar: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44013 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through <= 2.4.0.
- Product
- VR Calendar
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update VR Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024WP Booking Calendar: Stored Cross-Site ScriptingCVE-2024-9306 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. In addition, site administrators have the option to grant lower-level users with access to manage the plugin's settings which may extend this vulnerability to those users.
- Product
- WP Booking Calendar
- Affected
- up to 10.6
- What to do
- Affects up to 10.6. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 1, 2024QS Dark Mode: Stored Cross-Site ScriptingCVE-2024-9118 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The QS Dark Mode Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- QS Dark Mode
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update QS Dark Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 27, 2024Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2024-7149 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Event Manager, Events Calendar, Tickets, Registrations – Eventin
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 27, 2024The Events Calendar: Stored Cross-Site ScriptingCVE-2024-6931 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- The Events Calendar
- Affected
- up to 6.6.3
- What to do
- Affects up to 6.6.3. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 25, 2024The Events Calendar: SQL InjectionCVE-2024-8275 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.
- Product
- The Events Calendar
- Affected
- up to 6.6.4
- What to do
- Affects up to 6.6.4. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.theeventscalendar.complugins.trac.wordpress.org
Sep 24, 2024Simple Calendar – Google Calendar: Reflected Cross-Site ScriptingCVE-2024-8549 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Simple Calendar – Google Calendar
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Simple Calendar – Google Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2024WooEvents - Calendar and Event Booking: Arbitrary file overwriteCVE-2024-8671 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to overwrite arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- WooEvents - Calendar and Event Booking
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update WooEvents - Calendar and Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Sep 23, 2024Appointment & Event Booking Calendar Plugin – Webba Booking: Unauthorized modification of dataCVE-2024-8432 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_appearance() function in all versions up to, and including, 5.0.48. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the booking form's CSS.
- Product
- Appointment & Event Booking Calendar Plugin – Webba Booking
- Affected
- up to 5.0.48
- What to do
- Affects up to 5.0.48. Update Appointment & Event Booking Calendar Plugin – Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2024Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43969 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.12.
- Product
- Spiffy Calendar
- Affected
- up to 4.9.12
- What to do
- Affects up to 4.9.12. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45458 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
- Product
- Spiffy Calendar
- Affected
- up to 4.9.13
- What to do
- Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45457 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
- Product
- Spiffy Calendar
- Affected
- up to 4.9.13
- What to do
- Affects up to 4.9.13. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 14, 2024WP Booking System – Booking Calendar: Reflected Cross-Site ScriptingCVE-2024-8797 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Booking System – Booking Calendar
- Affected
- up to 2.0.19.8
- What to do
- Affects up to 2.0.19.8. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2024WP Simple Booking Calendar: Reflected Cross-Site ScriptingCVE-2024-8663 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Simple Booking Calendar
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update WP Simple Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2024Appointment Booking Calendar: Does not escape template syntax provided via user inputCVE-2024-7129 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
- Product
- Appointment Booking Calendar
- Fixed in
- 1.6.7.43
- What to do
- Update Appointment Booking Calendar to 1.6.7.43 or newer.
Sep 10, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access to Private or Password-protected eventsCVE-2024-8369 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view private or password-protected events.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.0.4.3
- What to do
- Affects up to 4.0.4.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Sep 5, 2024The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing CVE-2024-6332 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it possible for unauthenticated attackers to access employee calendar details, including Google Calendar OAuth tokens in the premium version.
- Affected
- up to Premium
- What to do
- Affects up to Premium. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2024WP Booking Calendar: Reflected Cross-Site ScriptingCVE-2024-8274 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Booking Calendar
- Affected
- up to 10.5
- What to do
- Affects up to 10.5. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2024Events Calendar Pro: PHP Object InjectionCVE-2024-8016 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In certain configurations, this can be exploitable by lower level users. We confirmed that this plugin installed with Elementor makes it possible for users with contributor-level access and above to exploit this issue.
- Product
- Events Calendar Pro
- Affected
- up to 7.0.2
- What to do
- Affects up to 7.0.2. Update Events Calendar Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtheeventscalendar.comtheeventscalendar.com
Aug 29, 2024IntoTheDark: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43958 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gianni Porto IntoTheDark allows Reflected XSS.This issue affects IntoTheDark: from n/a through 1.0.5.
- Product
- IntoTheDark
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update IntoTheDark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024Registrations for the Events Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-39638 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roundup WP Registrations for the Events Calendar allows SQL Injection.This issue affects Registrations for the Events Calendar: from n/a through 2.12.2.
- Product
- Registrations for the Events Calendar
- Affected
- up to 2.12.2
- What to do
- Affects up to 2.12.2. Update Registrations for the Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Dark Mode for WP Dashboard: Cross-Site Request Forgery (CSRF)CVE-2024-43325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.
- Product
- Dark Mode for WP Dashboard
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Dark Mode for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2024Booking for Appointments and Events Calendar – Amelia: Full Path DisclosureCVE-2024-6552 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 7, 2024Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress: Authentication bypassCVE-2024-7350 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email. This is only exploitable when the 'Auto login user after successful booking' setting is enabled.
- Product
- Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress
- Affected
- 1.1.6 to 1.1.7
- What to do
- Affects 1.1.6 to 1.1.7. Update Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 7, 2024Modern Events Calendar: Server-Side Request ForgeryCVE-2024-6522 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Modern Events Calendar
- Affected
- up to 7.12.1
- What to do
- Affects up to 7.12.1. Update Modern Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmec.webnus.netplugins.trac.wordpress.org
Jul 24, 2024WP Booking Calendar: Stored Cross-Site ScriptingCVE-2024-6930 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Booking Calendar
- Affected
- up to 10.2.1
- What to do
- Affects up to 10.2.1. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2024Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38692 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.
- Product
- Spiffy Calendar
- Affected
- up to 4.9.11
- What to do
- Affects up to 4.9.11. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 22, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37262 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.2.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 20, 2024Calendar.Online / Kalender.Digital: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38678 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Calendar.Online Calendar.Online / Kalender.Digital allows Stored XSS.This issue affects Calendar.Online / Kalender.Digital: from n/a through 1.0.8.
- Product
- Calendar.Online / Kalender.Digital
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Calendar.Online / Kalender.Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 17, 2024Booking Ultra Pro Appointments Booking Calendar: Unauthorized modification of dataCVE-2024-6175 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like save_fields_settings, bup_delete_user_avatar, bup_crop_avatar_user_profile_image, and more in all versions up to, and including, 1.1.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete. multiple plugin options and data such as payments, pricing, booking information, business hours, calendars, profile information, and email templates.
- Product
- Booking Ultra Pro Appointments Booking Calendar
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update Booking Ultra Pro Appointments Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.