Spiffyplugins

13 CVEs across 2 Spiffyplugins products. Browse Spiffyplugins vulnerabilities, severities, and proof-of-concept exploits.

Spiffyplugins products with known CVEs

ProductCVEs
Spiffy Calendar11
Wp Flow Plus2
Spiffyplugins CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-49695Medium6.52024-10-24Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored X…
CVE-2024-45458High7.12024-09-15Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Ref…
CVE-2024-45457Medium6.52024-09-15Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Sto…
CVE-2024-38692High7.62024-07-22Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This…
CVE-2024-30528Medium5.42024-06-04Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
CVE-2024-35651Medium6.52024-06-04Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows Stored XSS.This…
CVE-2024-30427Medium5.42024-03-29Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This…
CVE-2024-0855Medium5.32024-02-27The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to…
CVE-2023-49745Medium6.52023-12-14Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This iss…
CVE-2022-46859High8.52023-11-03Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL…
CVE-2023-32122Medium5.82023-08-18Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.
CVE-2022-29434Medium6.32022-05-20Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
CVE-2022-25599Medium5.42022-02-21Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).