CVE-2022-3852

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the plugin settings, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/vr-calendar-sync/tags/2.3.2/Admin/Classes/VRCalendarAdmin.class.php#L133Patch, Release Notes, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2809350%40vr-calendar-sync&new=2809350%40vr-calendar-sync&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a868226f-4ca1-4ec1-b55e-3029e3ed2d5b?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3852Third Party Advisory
• https://plugins.trac.wordpress.org/browser/vr-calendar-sync/tags/2.3.2/Admin/Classes/VRCalendarAdmin.class.php#L133Patch, Release Notes, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2809350%40vr-calendar-sync&new=2809350%40vr-calendar-sync&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3852Third Party Advisory

Published

Nov 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38497LIEF commit 365a16a was discovered to contain a segmentation…5.5
• CVE-2022-3850The Find and Replace All WordPress plugin before 1.3 does no…4.3
• CVE-2022-38509Wedding Planner v1.0 was discovered to contain a SQL injecti…9.8
• CVE-2022-38510Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer…7.8
• CVE-2022-38511TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contai…7.8
• CVE-2022-38512The Translation module in Liferay Portal v7.4.3.12 through v…6.5
• CVE-2022-38527UCMS v1.6.0 was discovered to contain a cross-site scripting…6.1
• CVE-2022-38528Open Asset Import Library (assimp) commit 3c253ca was discov…6.5
• CVE-2022-38529tinyexr commit 0647fb3 was discovered to contain a heap-buff…7.8
• CVE-2022-3853Cross-site Scripting (XSS) is a client-side code injection a…5.4
• CVE-2022-38530GPAC v2.1-DEV-rev232-gfcaa01ebb-master was discovered to con…7.8
• CVE-2022-38531FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnera…8.8