Plugin icon

Spiffy Calendar

spiffy-calendar

Vulnerabilities:

14

Last Updated:

April 17, 2026

Active Installs:

3000

Published
Title
Fixed in
CVSS
Published
2026-01-05
Title
Spiffy Calendar < 5.0.8 - Missing Authorization
Fixed in
Fixed in 5.0.8
CVSS
4.3 (medium)
Published
2024-09-12
Title
Spiffy Calendar < 4.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.9.14
CVSS
6.4 (medium)
Published
2024-09-12
Title
Spiffy Calendar < 4.9.14 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.9.14
CVSS
6.1 (medium)
Published
2024-08-28
Title
Spiffy Calendar < 4.9.13 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 4.9.13
CVSS
4.9 (medium)
Published
2024-07-10
Title
Spiffy Calendar < 4.9.12 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 4.9.12
CVSS
9.1 (critical)
Published
2024-03-29
Title
Spiffy Calendar < 4.9.11 - Missing Authorization
Fixed in
Fixed in 4.9.11
CVSS
4.3 (medium)
Published
2024-03-28
Title
Spiffy Calendar < 4.9.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.9.10
CVSS
6.1 (medium)
Published
2024-01-12
Title
Spiffy Calendar < 4.9.9 - Broken Access Control
Fixed in
Fixed in 4.9.9
CVSS
2.7 (low)
Published
2023-12-01
Title
Spiffy Calendar < 4.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.9.6
CVSS
6.4 (medium)
Published
2023-05-03
Title
Spiffy Calendar < 4.9.4 - Reflected XSS
Fixed in
Fixed in 4.9.4
CVSS
5.8 (medium)
Published
2023-04-07
Title
Spiffy Calendar < 4.9.2 - SQL Injection
Fixed in
Fixed in 4.9.2
CVSS
7.7 (high)
Published
2022-02-10
Title
Spiffy Calendar < 4.9.1 - Subscriber+ Arbitrary Event Edition/Deletion via IDOR
Fixed in
Fixed in 4.9.1
CVSS
6.3 (medium)
Published
2022-02-10
Title
Spiffy Calendar < 4.9.1 - Arbitrary Event Deletion via CSRF
Fixed in
Fixed in 4.9.1
CVSS
5.4 (medium)
Published
2017-06-02
Title
Spiffy Calendar < 3.3.0 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.3.0
CVSS
6.1 (medium)