plugin

Event Easy Calendar Vulnerabilities

2 known security issues reported for the Event Easy Calendar WordPress plugin. Most recent disclosed Sep 7, 2013.

1 high 1 medium

Running Event Easy Calendar on your site? Check whether your installed version is affected.

Scan your site free

Event Easy Calendar <= 1.0.0 - Multiple Cross-Site Request Forgery

high

The Event Easy Calendar plugin for WordPress is vulnerable to Multiple Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions via a forged reques...

CVSS:
8.8
Affected:
up to 1.0
Fix:
No patched version reported
Disclosed:
Sep 7, 2013

Event Easy Calendar <= 1.0.0 - Cross-Site Scripting

medium

The Event Easy Calendar plugin for WordPress is vulnerable to Cross-Site Scripting via several parameters in versions up to, and including, 1.0.0due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:
6.1
Affected:
up to 1.0.0
Fix:
No patched version reported
Disclosed:
Sep 7, 2013

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database