CVE-2022-2846

Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS

The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.

Affected

Calendar Event Multi View

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

2.70% chance of exploitation in the next 30 days, 86th percentile

Published

2022-08-16

Updated

2025-04-15

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51241

References

• CVE Record
• NVD entry