Mf Gig Calendar Vulnerabilities

The MF Gig Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site admin...

CVSS:

4.3

Affected:

up to 1.2.1

Fix:

No patched version reported

Disclosed:

Apr 25, 2024

CVE-2024-33651 on NVD →

The MF Gig Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject a...

CVSS:

4.4

Affected:

up to 1.2.1

Fix:

No patched version reported

Disclosed:

Apr 15, 2024

CVE-2024-3755 on NVD →

The MF Gig Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the mf_gig_calendar page. This makes it possible for unauthenticated attackers to delete events via a forged request granted they can...

CVSS:

4.3

Affected:

up to 1.2.1

Fix:

No patched version reported

Disclosed:

Apr 15, 2024

CVE-2024-3756 on NVD →

The MF Gig Calendar plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...

CVSS:

8.8

Affected:

up to 1.2.1

Fix:

No patched version reported

Disclosed:

Dec 21, 2023

CVE-2023-50842 on NVD →

The MF Gig Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event's time and title parameters in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

CVSS:

6.4

Affected:

up to 1.2

Fixed in:

1.2.1

Disclosed:

Jul 12, 2023

CVE-2023-37970 on NVD →

The MF Gig Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' GET parameter in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 1.1

Fixed in:

1.2

Disclosed:

Aug 17, 2021

CVE-2021-24510 on NVD →

Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin < 0.9.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.

CVSS:

6.1

Affected:

up to 0.9.4.1

Fixed in:

0.9.5

Disclosed:

Sep 23, 2012

CVE-2012-4242 on NVD →