CVE-2022-2314

CVE-2022-2314: VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call

Vendor Unknown

Product VR Calendar

Weakness CWE-78

Published August 15, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.

Key dates

02Disclosure timeline

August 15, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2314 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/78.html AskarLabs — CWE-78 write-up OS Command Injection

Related vulnerabilities

04Related CVE

CVE-2024-51661 WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability CVE-2023-7002 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url CVE-2025-31692 AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021 CVE-2023-25699 WordPress VideoWhisper Live Streaming Integration plugin <= 5.5.15 - Remote Code Execution (RCE) CVE-2025-2257 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection