Simple Calendar For Elementor Vulnerabilities

The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the `miga_ajax_editor_cal_delete` function that is hooked to the `miga_editor_cal_delete` AJAX action with both authenticated and unauthe...

CVSS:

5.3

Affected:

up to 1.6.6

Fixed in:

1.6.7

Disclosed:

Jan 27, 2026

CVE-2026-1310 on NVD →

The Simple calendar for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missing or incorrect nonce validation on the miga_ajax_editor_cal_delete() and miga_ajax_editor_cal_update() functions. This makes it possible for unauthenticated at...

CVSS:

4.3

Affected:

up to 1.6.5

Fixed in:

1.6.6

Disclosed:

May 7, 2025

CVE-2025-47542 on NVD →

The Simple calendar for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can tric...

CVSS:

4.3

Affected:

up to 1.6.4

Fixed in:

1.6.5

Disclosed:

Apr 22, 2025

CVE-2025-46249 on NVD →