CVE-2022-2846
Last modified
CVE-2022-2846 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.. EPSS estimates a 2.18% chance of exploitation in the next 30 days.
Description
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dwbooster | Calendar Event Multi View | < 1.4.07 |
References
- https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657cExploit, Third Party Advisory
- https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657cExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2846?
How severe is CVE-2022-2846?
How do I fix CVE-2022-2846?
Are you affected by CVE-2022-2846?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST