Unknown Eventcalendar vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Eventcalendar, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2021-25024theeventscalendareventcalendar+2
EPSS score
0.81%
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues4.3CVE-2021-25025theeventscalendareventcalendar+2
EPSS score
0.35%
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events