Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

611 results · page 7 of 13

Apr 4, 2025Booking Calendar and Notification: Missing AuthorizationCVE-2025-31381 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar and Notification: from n/a through <= 4.0.3.
Product
Booking Calendar and Notification
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025CGM Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rzfarrell CGM Event Calendar cgm-event-calendar allows Reflected XSS.This issue affects CGM Event Calendar: from n/a through <= 0.8.5.
Product
CGM Event Calendar
Affected
up to 0.8.5
What to do
Affects up to 0.8.5. Update CGM Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Ethiopian Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kibru Demeke Ethiopian Calendar ethiopian-calendar allows Stored XSS.This issue affects Ethiopian Calendar: from n/a through <= 1.1.1.
Product
Ethiopian Calendar
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Ethiopian Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Multi Days Events and Multi Events in One Day Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-31572 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through <= 1.1.3.
Product
Multi Days Events and Multi Events in One Day Calendar
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Multi Days Events and Multi Events in One Day Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Booking for Appointments and Events Calendar – Amelia: Full Path DisclosureCVE-2025-2578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2025Simple Google Calendar Outlook Events Block Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22497 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outlook Events Block Widget simple-google-icalendar-widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through <= 2.5.0.
Product
Simple Google Calendar Outlook Events Block Widget
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Simple Google Calendar Outlook Events Block Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025bizcalendar-web: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30843 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in setriosoft bizcalendar-web bizcalendar-web allows SQL Injection.This issue affects bizcalendar-web: from n/a through <= 1.1.0.34.
Product
bizcalendar-web
Affected
up to 1.1.0.34
What to do
Affects up to 1.1.0.34. Update bizcalendar-web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Google Calendar Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28939 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EuroCizia WP Google Calendar Manager wp-gcalendar allows Blind SQL Injection.This issue affects WP Google Calendar Manager: from n/a through <= 2.1.
Product
WP Google Calendar Manager
Affected
up to 2.1
What to do
Affects up to 2.1. Update WP Google Calendar Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Another Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar another-events-calendar allows Reflected XSS.This issue affects Another Events Calendar: from n/a through <= 1.7.0.
Product
Another Events Calendar
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Another Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Registrations for the Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-10703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Registrations for the Events Calendar
Fixed in
2.13.4
What to do
Update Registrations for the Events Calendar to 2.13.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2025-1770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.24
What to do
Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.24
What to do
Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Arbitrary shortcode executionCVE-2025-1119 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.8.5
What to do
Affects up to 1.6.8.5. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.lucianohanna.com.br plugins.trac.wordpress.org
Mar 7, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Reflected Cross-Site ScriptingCVE-2024-13431 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.8.3
What to do
Affects up to 1.6.8.3. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.lucianohanna.com.br plugins.trac.wordpress.org
Mar 6, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-13526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.0.7.3
What to do
Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 3, 2025Events Calendar for GeoDirectory: Deserialization of Untrusted DataCVE-2025-26967 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.
Product
Events Calendar for GeoDirectory
Affected
up to 2.3.14
What to do
Affects up to 2.3.14. Update Events Calendar for GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Swift Calendar Online Appointment Scheduling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SwiftCloud Swift Calendar Online Appointment Scheduling online-appointment-scheduling-software allows Reflected XSS.This issue affects Swift Calendar Online Appointment Scheduling: from n/a through <= 1.3.3.
Product
Swift Calendar Online Appointment Scheduling
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Swift Calendar Online Appointment Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 1, 2025Booking Calendar and Notification: Unauthorized access, modification, and loss of dataCVE-2024-13746 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts.
Product
Booking Calendar and Notification
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 21, 2025Events Calendar Made Simple – Pie Calendar: Stored Cross-Site ScriptingCVE-2025-1410 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Events Calendar Made Simple – Pie Calendar
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Events Calendar Made Simple – Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 21, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Time-based SQL InjectionCVE-2024-11260 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 6.6.3
What to do
Affects up to 6.6.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025GetBookingsWP – Appointments Booking Calendar Plugin For: Privilege escalationCVE-2024-13677 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
GetBookingsWP – Appointments Booking Calendar Plugin For
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update GetBookingsWP – Appointments Booking Calendar Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2025WP Booking Calendar: Unauthenticated Post-Confirmation Booking ManipulationCVE-2024-13821 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This makes it possible for unauthenticated attackers to manipulate their confirmed bookings, even after they have been approved.
Product
WP Booking Calendar
Affected
up to 10.10
What to do
Affects up to 10.10. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 27, 2025The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-24537 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through <= 6.7.0.
Product
The Events Calendar
Affected
up to 6.7.0
What to do
Affects up to 6.7.0. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24723 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
Product
Booking Calendar Contact Form
Affected
up to 1.2.55
What to do
Affects up to 1.2.55. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025The Events Calendar: Stored Cross-Site ScriptingCVE-2024-12118 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Events Calendar
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 21, 2025VikAppointments Services Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22719 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikappointments allows Stored XSS.This issue affects VikAppointments Services Booking Calendar: from n/a through <= 1.2.16.
Product
VikAppointments Services Booking Calendar
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update VikAppointments Services Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Standard Box Sizes – for WooCommerce: Missing AuthorizationCVE-2025-22318 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for WooCommerce: from n/a through <= 1.6.13.
Product
Standard Box Sizes – for WooCommerce
Affected
up to 1.6.13
What to do
Affects up to 1.6.13. Update Standard Box Sizes – for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Event Registration Calendar By vcita: Stored Cross-Site ScriptingCVE-2024-11870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Event Registration Calendar By vcita
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Event Registration Calendar By vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2025WP Booking Calendar: Stored Cross-Site ScriptingCVE-2024-13323 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Booking Calendar
Affected
up to 10.9.2
What to do
Affects up to 10.9.2. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2025Appointment Booking Calendar Plugin and Scheduling: Export settings functionality exports data to a public folderCVE-2024-12274 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).
Product
Appointment Booking Calendar Plugin and Scheduling
Fixed in
1.1.23
What to do
Update Appointment Booking Calendar Plugin and Scheduling to 1.1.23 or newer.
Full record and what to do →NVD record wpscan.com
Jan 9, 2025Live Flight Radar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22824 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lucia.intelisano Live Flight Radar live-flight-radar allows Stored XSS.This issue affects Live Flight Radar: from n/a through <= 1.0.
Product
Live Flight Radar
Affected
up to 1.0
What to do
Affects up to 1.0. Update Live Flight Radar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP FullCalendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22261 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through <= 1.5.
Product
WP FullCalendar
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versCVE-2024-12077 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025The Events Calendar: Cross-Site Request Forgery (CSRF)CVE-2024-37518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n/a through <= 6.5.1.4.
Product
The Events Calendar
Affected
up to 6.5.1.4
What to do
Affects up to 6.5.1.4. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: SQL InjectionCVE-2024-11726 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter of the 'bookingpress_form' shortcode in all versions up to, and including, 1.1.21 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
Affected
up to 1.1.21
What to do
Affects up to 1.1.21. Update Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024Booking Calendar WpDevArt: Time-based, blind SQL injectionCVE-2024-10856 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerability requires the “delete_prev_date” theme option being enabled. This makes it possible for authenticated attackers, with contributor-level access or above, to append additional SQL queries into already existing query that can be used to extract sensitive information such as passwords from the database.
Product
Booking Calendar WpDevArt
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Booking Calendar WpDevArt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-12024 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em_ticket_individual_data parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page. Note: this vulnerability requires the "Guest Submissions" setting to be enabled. It is disabled by default.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.0.7.3
What to do
Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Cross-Site Request Forgery (CSRF)CVE-2024-54356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5
What to do
Affects up to 4.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Events Calendar: Is missing access checks in the REST APICVE-2024-5333 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
Product
Events Calendar
Fixed in
6.8.2.1
What to do
Update Events Calendar to 6.8.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 14, 2024Koalendar – Events & Appointments Booking Calendar: Stored Cross-Site ScriptingCVE-2024-11855 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Koalendar – Events & Appointments Booking Calendar
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Koalendar – Events & Appointments Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024DX Dark Site: Cross-Site Request Forgery (CSRF)CVE-2024-54337 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DevriX DX Dark Site devrix-dark-site allows Stored XSS.This issue affects DX Dark Site: from n/a through <= 1.0.1.
Product
DX Dark Site
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update DX Dark Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024The Events Calendar: Missing AuthorizationCVE-2023-35777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2.
Product
The Events Calendar
Affected
up to 6.1.2.2
What to do
Affects up to 6.1.2.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Unauthorized loss of dataCVE-2024-11275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
Product
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Add infos to the events calendar: Stored Cross-Site ScriptingCVE-2024-11875 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Add infos to the events calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Add infos to the events calendar
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Add infos to the events calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Booking Calendar Contact Form: Missing AuthorizationCVE-2023-25037 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.
Product
Booking Calendar Contact Form
Affected
up to 1.2.34
What to do
Affects up to 1.2.34. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2023-24407 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024CP Multi View Event Calendar: Missing AuthorizationCVE-2023-23814 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through 1.4.13.
Product
CP Multi View Event Calendar
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2024-9872 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_user_data_callback() function in all versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts and update settings.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 3, 2024WP Booking Calendar: Does not sanitise and escape some of its settingsCVE-2024-10893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Booking Calendar
Fixed in
10.6.5
What to do
Update WP Booking Calendar to 10.6.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 26, 2024Sugar Calendar – Simple Event Management: Reflected Cross-Site ScriptingCVE-2024-10878 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Sugar Calendar – Simple Event Management
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Sugar Calendar – Simple Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.