My Calendar < 3.3.25 - Event/Location Deletion via CSRF

2023-01-0400:00:00

wpscan.com

calendar plugin

csrf attack

event deletion

location deletion

admin vulnerability

0.001 Low

EPSS

Percentile

27.7%

JSON

The plugin does not have CSRF checks when deleting events and locations, which could allow attackers to make logged in admins perform such actions via CSRF attacks

CPENameOperatorVersion
my-calendarlt3.3.25

CPE	Name	Operator	Version
	my-calendar	lt	3.3.25

0.001 Low

EPSS

Percentile

27.7%

JSON

Related for WPVDB-ID:015A9DB0-9C91-4E69-BC4C-909C3CF6C7F6