Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · spiffy-calendar
Spiffy Calendar
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Dec 24, 2025Spiffy Calendar: Missing AuthorizationCVE-2025-68523 · affects up to 5.0.7 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.
Sep 17, 2024Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43969 · affects up to 4.9.12 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.12.
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45458 · affects up to 4.9.13 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
Sep 15, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45457 · affects up to 4.9.13 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
Jul 22, 2024Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38692 · affects up to 4.9.11 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.
Jun 4, 2024Spiffy Calendar: Missing AuthorizationCVE-2024-30528 · affects up to 4.9.10 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
Mar 29, 2024Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30427 · affects up to 4.9.7 · reported by PatchstackMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through 4.9.7.
Feb 27, 2024Spiffy Calendar: Doesn't check the event_author parameterCVE-2024-0855 · fixed in 4.9.9 · reported by WPScanMedium 5.3
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
Dec 14, 2023Spiffy Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49745 · affects up to 4.9.5 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.
Nov 3, 2023Spiffy Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-46859 · affects up to 4.9.1 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.1.
Aug 18, 2023Unauth.CVE-2023-32122 · affects up to 4.9.3 · reported by PatchstackMedium 5.8
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.
May 20, 2022Spiffy Plugins Spiffy Calendar <= 4.9.0 at: Insecure Direct Object References (IDOR)CVE-2022-29434 · affects up to 4.9.0 · reported by PatchstackMedium 6.3
Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).CVE-2022-25599 · affects up to 4.9.0 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.