Google Calendar Events Vulnerabilities

[en] Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Calendar Events: from n/a through <= 3.5.9.

Affected:

up to 3.5.9

Fix:

No patched version reported

Disclosed:

Dec 30, 2025

CVE-2025-68979 on NVD →

The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.5.9 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.5.9

Fixed in:

3.6.0

Disclosed:

Dec 18, 2025

CVE-2025-68979 on NVD →

[en] The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

Affected:

up to 3.4.3

Fixed in:

3.4.3

Disclosed:

Sep 25, 2024

CVE-2024-8549 on NVD →

The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p...

CVSS:

6.1

Affected:

up to 3.4.2

Fixed in:

3.4.3

Disclosed:

Sep 24, 2024

CVE-2024-8549 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Calendar Simple Calendar – Google Calendar Plugin allows Stored XSS.This issue affects Simple Calendar – Google Calendar Plugin: from n/a through 3.2.6.

Affected:

up to 3.2.8

Fixed in:

3.2.8

Disclosed:

Dec 14, 2023

CVE-2023-49151 on NVD →

The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attack...

CVSS:

6.4

Affected:

up to 3.2.7

Fixed in:

3.2.8

Disclosed:

Nov 28, 2023

CVE-2023-49151 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Simple Calendar – Google Calendar Plugin <= 3.2.5 versions.

Affected:

up to 3.2.6

Fixed in:

3.2.6

Disclosed:

Oct 24, 2023

CVE-2023-46189 on NVD →

The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 3.2.5 (exclusive). This is due to missing or incorrect nonce validation on the duplicate_feed function. This makes it possible for unauthenticated attackers to duplicate feeds via a forged...

CVSS:

4.3

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Oct 20, 2023

The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 3.2.5 (exclusive). This is due to missing or incorrect nonce validation on the duplicate_feed function. This makes it possible for unauthenticated attackers to duplicate feeds via a forged...

Affected:

up to 3.2.5

Fixed in:

3.2.5

Disclosed:

Oct 20, 2023

The Google Calendar Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.5. This is due to missing nonce validation on the 'bulk_actions' function. This makes it possible for unauthenticated attackers to perform bulk actions via a forged request granted they can...

CVSS:

4.3

Affected:

up to 3.2.5

Fixed in:

3.2.6

Disclosed:

Oct 18, 2023

CVE-2023-46189 on NVD →

The Simple Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.42. This is due to missing nonce validation on the clear_cache() function used to clear the plugin's transients. This makes it possible for unauthenticated attackers to clear the plugin's transient...

CVSS:

4.3

Affected:

up to 3.1.42

Fixed in:

3.1.43

Disclosed:

May 11, 2023

The Simple Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.42. This is due to missing nonce validation on the clear_cache() function used to clear the plugin's transients. This makes it possible for unauthenticated attackers to clear the plugin's transient...

Affected:

up to 3.1.43

Fixed in:

3.1.43

Disclosed:

May 11, 2023

[en] Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.

Affected:

up to 2.0.4

Fixed in:

2.0.4

Disclosed:

Oct 16, 2014

CVE-2014-7138 on NVD →

Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.

CVSS:

6.1

Affected:

up to 2.0.4

Fixed in:

2.0.4

Disclosed:

Oct 8, 2014

CVE-2014-7138 on NVD →

The Simple Calendar &ndash; Google Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 3.2.5 (exclusive). This is due to missing or incorrect nonce validation on the duplicate_feed function. This makes it possible for unauthenticated attackers to duplicate feeds via a...

Affected:

up to 3.2.5

Fixed in:

3.2.5