{"schemaVersion":3,"id":"CVE-2022-2846","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.","dates":{"published":"2022-08-16T00:00:00.000Z","modified":"2025-04-15T13:07:52.842Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.2,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":7.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02702,"percentile":0.85813,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.05699999999999976,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.02645},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.02702,"percentile":0.85813}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02645,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02702,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.02702,"percentile":0.85813}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_C3F2F5BEC2196470","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"51241","name":"Calendar Event Multi View  1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/51241","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["php"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"php","file":"exploits/php/webapps/51241.txt","codes":["CVE-2022-2846"]},"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"},{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"dwbooster","product":"calendar_event_multi_view","name":"calendar event multi view","label":"calendar_event_multi_view","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.4.07","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.07","eol":null,"hubHref":"/vendor/dwbooster/calendar_event_multi_view"},{"vendor":"unknown","product":"calendar event multi view","name":"Calendar Event Multi View","label":"calendar event multi view","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.4.07, < 1.4.07","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.4.07, < 1.4.07","eol":null,"hubHref":"/vendor/unknown/calendar_event_multi_view"},{"vendor":"wordpress","product":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","label":"cp-multi-view-calendar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.4.06 (fixed in 1.4.07)","noFixRecorded":false,"fixedIn":"1.4.07"}],"versionsText":"≤ 1.4.06 (fixed in 1.4.07)","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c","label":"wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c","hostname":"wpscan.com","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html","label":"packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html","hostname":"packetstormsecurity.com","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488bafe4-746a-4531-95ac-30d17ace2239","label":"www.wordfence.com/threat-intel/vulnerabilities/id/488bafe4-746a-4531-95ac-30d17ace2239","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-08-16T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-04-15T13:07:52.842Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":39,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T07:57:57.550Z","stale":false,"partial":false}}