WordPress Plugin Vulnerabilities

Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id

Description

The plugin does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

Proof of Concept

Affects Plugins

Plugin icon
simple-google-icalendar-widget
Fixed in 3.1.0

References

CVE
CVE-2026-16536

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter website
https://telefonica.com
Verified
Yes
WPVDB ID
effa5549-ecfa-45ba-9044-7345d674c2ca

Timeline

Publicly Published
2026-07-25 (about 10 days ago)
Added
2026-07-25 (about 9 days ago)
Last Updated
2026-07-25 (about 9 days ago)

Other

Published
Title
Published
2025-12-04
Title
Time Sheets <= 2.1.3 - Use of Known Vulnerable Component
Published
2024-08-29
Title
Justified Image Grid < 4.7 - Unauthenticated Server-Side Request Forgery
Published
2025-01-24
Title
Chained Quiz < 1.3.3 - Authenticated (Admin+) Server-Side Request Forgery
Published
2025-03-31
Title
WP Link Preview <= 1.4.1 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2026-07-27
Title
Feedzy < 5.2.5 - Authenticated (Contributor+) Server-Side Request Forgery