WordPress Plugin Vulnerabilities

Event Calendar WD <= 1.0.93 - Authenticated Cross-Site Scripting (XSS)

Description

The Event Calendar WD – Responsive Event Calendar plugin WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
event-calendar-wd
Fixed in 1.0.94

References

CVE
CVE-2017-2224
URL
https://jvn.jp/en/jp/JVN73550134/index.html
URL
https://plugins.trac.wordpress.org/changeset/1671891/#file313

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
d2032065-faab-40c2-972a-329e19e2a031

Timeline

Publicly Published
2017-06-06 (about 8 years ago)
Added
2017-07-16 (about 8 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2022-05-30
Title
Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site Scripting
Published
2021-09-22
Title
YT Player < 1.4 - Contributor+ Stored Cross-Site Scripting
Published
2022-12-14
Title
Permalink Manager Lite < 2.3.0 - Authenticated Stored XSS
Published
2025-06-25
Title
WP SoundSystem <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode
Published
2025-01-30
Title
Table Editor < 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting