CVE-2022-2846

CVE-2022-2846: Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS

Vendor Unknown

Product Calendar Event Multi View

Weakness CWE-862 · Missing authorization

Published August 16, 2022

Last update April 15, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.

Key dates

02Disclosure timeline

August 16, 2022 CVE published

April 15, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2846 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-30639 WordPress IDonatePro Plugin <= 2.1.9 - Broken Access Control Vulnerability CVE-2026-33685 AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data CVE-2025-30864 WordPress Exchange Rates plugin <= 1.2.2 - Broken Access Control vulnerability CVE-2025-57944 WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3 - Broken Access Control vulnerability CVE-2025-31596 WordPress Chat by Chatwee plugin <= 2.1.3 - Broken Access Control vulnerability