CVE-2022-2846

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-862 CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Aug 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-284619.8mingyuefusu Library Management System all versions as of 03-27-2022 is vulnerable to SQL Injection.CVE-2022-284627.5novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.CVE-2022-284637.8ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.CVE-2022-284649.0Apifox through 2.1.6 is vulnerable to Cross Site Scripting (XSS) which can lead to remote code execution.CVE-2022-284679.8Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter.CVE-2022-284689.8Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.CVE-2022-28479.8A vulnerability, which was classified as critical, has been found in SourceCodester Guest Management System. This issue affects some unknown CVE-2022-284709.8marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.CVE-2022-284716.5In ffjpeg (commit hash: caade60), the function bmp_load() in bmp.c contains an integer overflow vulnerability, which eventually results in t CVE-2022-284776.1WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).CVE-2022-284786.5SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does CVE-2022-284794.8SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside t