CVE-2024-0855

2024-02-2709:15:37

[email protected]

web.nvd.nist.gov

2819

cve-2024-0855

spiffy calendar

wordpress

plugin

security vulnerability

event_author parameter

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Spiffy Calendar WordPress plugin before 4.9.9 doesn’t check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.

Affected configurations

Vulners

Node

sunnythemesspiffy_calendarRange<4.9.9

VendorProductVersionCPE
sunnythemesspiffy_calendar*cpe:2.3:a:sunnythemes:spiffy_calendar:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sunnythemes	spiffy_calendar	*	cpe:2.3:a:sunnythemes:spiffy_calendar::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Spiffy Calendar",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "4.9.9"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]