Spiffy Plugins

15 CVEs across 3 Spiffy Plugins products. Browse Spiffy Plugins vulnerabilities, severities, and proof-of-concept exploits.

Spiffy Plugins products with known CVEs

ProductCVEs
Spiffy Calendar11
Wp Flow Plus3
Spiffy Calendar (WordPress Plugin)1
Spiffy Plugins CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-68523Medium4.32025-12-24Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.T…
CVE-2025-58625Medium5.92025-09-03Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored X…
CVE-2024-49695Medium6.52024-10-24Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored X…
CVE-2024-43969High7.62024-09-17Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This…
CVE-2024-45458High7.12024-09-15Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Ref…
CVE-2024-45457Medium6.52024-09-15Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Sto…
CVE-2024-38692High7.62024-07-22Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This…
CVE-2024-30528Medium5.42024-06-04Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
CVE-2024-35651Medium6.52024-06-04Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows Stored XSS.This…
CVE-2024-30427Medium5.42024-03-29Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This…
CVE-2023-49745Medium6.52023-12-14Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This iss…
CVE-2022-46859High8.52023-11-03Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL…
CVE-2023-32122Medium5.82023-08-18Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.
CVE-2022-29434Medium6.32022-05-20Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
CVE-2022-25599Medium5.42022-02-21Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).