What is CVE-2022-2846?

CVE-2022-2846 is a medium-severity vulnerability in Dwbooster Calendar Event Multi View, classified under Cross-site Scripting. CVSS score: 4.3/10. Published 2022-08-16.

How severe is CVE-2022-2846?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2022-2846 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Dwbooster Calendar Event Multi View

CVE-2022-2846

The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.023 (81.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Dwbooster Calendar_event_multi_view
Unknown Calendar Event Multi View — versions 1.4.07

Weakness classification (CWE)

Public proof-of-concept exploits

20142995/nuclei-templates

References

cna@vuldb.com (Exploit, Third Party Advisory)
cna@vuldb.com

Frequently asked questions

What is CVE-2022-2846?: CVE-2022-2846 is a medium-severity vulnerability in Dwbooster Calendar Event Multi View, classified under Cross-site Scripting. CVSS score: 4.3/10. Published 2022-08-16.
How severe is CVE-2022-2846?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2022-2846 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.