Simple Google Calendar Outlook Events Widget <= 3.0.0 - Unauthenticated Server-Side Request Forgery
high
The Simple Google Calendar Outlook Events Widget plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.0.0. This is due to missing whitelist validation on REST request parameters, allowing calendar_id to be passed directly as a block attribute and trigger arbitrary URL fe...
- CVSS:
- 7.2
- Affected:
- up to 3.0.0
- Fixed in:
- 3.1.0
- Disclosed:
- Jul 25, 2026
CVE-2026-16536 on NVD →
Simple Google Calendar Outlook Events Widget [simple-google-icalendar-widget] < 2.6.0
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A.H.C. Waasdorp Simple Google Calendar Outlook Events Block Widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through 2.5.0.
- Affected:
- up to 2.6.0
- Fixed in:
- 2.6.0
- Disclosed:
- Mar 27, 2025
CVE-2025-22497 on NVD →
Simple Google Calendar Outlook Events Block Widget <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Simple Google Calendar Outlook Events Block Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inj...
- CVSS:
- 6.4
- Affected:
- up to 2.5.0
- Fixed in:
- 2.6.0
- Disclosed:
- Feb 11, 2025
CVE-2025-22497 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database