Wp Datepicker Vulnerabilities

The WP Datepicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpdp_get_selected_datepicker' parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scr...

CVSS:

6.1

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

Dec 23, 2024

CVE-2024-12468 on NVD →

The WP Datepicker plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

Sep 25, 2024

CVE-2024-47321 on NVD →

The WP Datepicker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages...

CVSS:

4.4

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

Sep 23, 2024

CVE-2024-44042 on NVD →

The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax() function in all versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update a...

CVSS:

8.8

Affected:

up to 2.1.0

Fixed in:

2.1.1

Disclosed:

Apr 23, 2024

CVE-2024-3895 on NVD →