Smart Agenda Prise De Rendez Vous En Ligne Vulnerabilities

The Smart Agenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 4.9

Fixed in:

5.0

Disclosed:

Jun 27, 2025

CVE-2025-53294 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda allows Stored XSS. This issue affects Smart Agenda: from n/a through 4.9.

Affected:

up to 5.0

Fixed in:

5.0

Disclosed:

Jun 27, 2025

CVE-2025-53294 on NVD →

Affected:

up to 4.7

Fix:

No patched version reported

Disclosed:

Jan 14, 2025

CVE-2024-13348 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartAgenda Smart Agenda allows Stored XSS.This issue affects Smart Agenda: from n/a through 4.7.

Affected:

up to 4.8

Fixed in:

4.8

Disclosed:

Jan 13, 2025

CVE-2025-22506 on NVD →

The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7. This is due to missing or incorrect nonce validation on the smartagenda_options_page_html() function. This makes it possible for unauthenticated attackers to updat...

CVSS:

6.1

Affected:

up to 4.7

Fixed in:

4.8

Disclosed:

Jan 7, 2025

CVE-2025-22506 on NVD →

[en] The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for au...

Affected:

up to 4.7

Fixed in:

4.7

Disclosed:

Dec 12, 2024

CVE-2024-11781 on NVD →

The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent...

CVSS:

6.4

Affected:

up to 4.6

Fixed in:

4.7

Disclosed:

Dec 11, 2024

CVE-2024-11781 on NVD →