Connect Daily Web Calendar Vulnerabilities

The WordPress Events Calendar Plugin – connectDaily plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVSS:

6.4

Affected:

up to 1.5.4

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58862 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily allows Stored XSS. This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through 1.5.3.

Affected:

up to 1.5.3

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58862 on NVD →

The WordPress Events Calendar Plugin – connectDaily plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicio...

CVSS:

6.1

Affected:

up to 1.5.4

Fixed in:

1.5.5

Disclosed:

Apr 9, 2025

CVE-2025-32597 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily allows Cross-Site Scripting (XSS). This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through 1.4.8.

Affected:

up to 1.5.1

Fix:

No patched version reported

Disclosed:

Apr 9, 2025

CVE-2025-32597 on NVD →

[en] The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).

Affected:

up to 1.4.5

Fixed in:

1.4.5

Disclosed:

Jan 16, 2023

CVE-2022-4320 on NVD →

The connectDaily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if t...

CVSS:

5.5

Affected:

up to 1.4.4

Fixed in:

1.4.5

Disclosed:

Dec 19, 2022

CVE-2022-4320 on NVD →