Extension WordPress
Vulnérabilités Availability Calendar
Cette page rassemble les failles publiées pour Availability Calendar, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Availability Calendar
3 fiches
Availability Calendar <= 1.2.6 – Cross-Site Request Forgery via add_availability_calendar_create_admin_page()
The Availability Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the add_availability_calendar_create_admin_page() function. This makes it possible for unauthenticated…
*-1.2.6
Non indiqué
24/11/2023
Availability Calendar < 1.2.1 – SQL Injection
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to…
[*, 1.2.1)
1.2.1
04/08/2021
Availability Calendar <= 1.2.1 – Stored Cross-Site Scripting
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the…
*-1.2.1
1.2.2
03/08/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.