CVE-2021-25025

CVE-2021-25025: Event Calendar < 1.1.51 - Subscriber+ Event Creation

Vendor Unknown
Product EventCalendar
Weakness CWE-352 · CSRF
Published January 17, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

Key dates

02Disclosure timeline

January 17, 2022 CVE published
August 3, 2024 Record updated