Skip to content
Sign in
Not rated

CVE-2021-25025 The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the…

Description

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

Affected products and versions

Product Affected versions Fixed in
EventCalendar 1.1 earliest → < 1.1.51 1.1.51

Other CVEs of EventCalendar

The 2 CVEs of EventCalendar →
CVE-2021-25024 The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in… Not rated
Track this CVE