{"schemaVersion":3,"id":"CVE-2022-36371","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The My Calendar plugin for WordPress is vulnerable to Open Redirection in versions up to, and including, 3.3.16. This makes it possible for unauthenticated attackers to create links that look to be part of an affected site, but will redirect to the attacker's target. This vulnerability can be utilized for malicious redirection and can also be used for phishing.","dates":{"published":"2022-08-02T00:00:00.000Z","modified":"2024-01-22T19:56:02.000Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.7,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site ('Open Redirect')","description":"The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Low","url":"https://cwe.mitre.org/data/definitions/601.html"}],"affected":[{"vendor":"wordpress","product":"my-calendar","name":"My Calendar – Accessible Event Manager","label":"my-calendar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.3.16 (fixed in 3.3.17)","noFixRecorded":false,"fixedIn":"3.3.17"}],"versionsText":"≤ 3.3.16 (fixed in 3.3.17)","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e77d240-475d-41a2-9b88-1332fc60b72d","label":"www.wordfence.com/threat-intel/vulnerabilities/id/6e77d240-475d-41a2-9b88-1332fc60b72d","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-08-02T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-01-22T19:56:02.000Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:49:58.115Z","stale":false,"partial":false}}