CVE-2024-0855

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	Spiffy Calendar	< 4.9.9
spiffyplugins	spiffy_calendar	< 4.4.9

References

https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/Exploit, Third Party Advisory

Timeline

Published: Feb 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-08568.8The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to mak CVE-2024-08579.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corp CVE-2024-08588.8The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in user CVE-2024-08594.3The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This i CVE-2024-08607.5The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to captur CVE-2024-08614.3An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16 CVE-2024-08625.0The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an a CVE-2024-08649.8Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an imprope CVE-2024-08657.8CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrati CVE-2024-08668.1The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via t CVE-2024-08678.1The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check CVE-2024-08685.3The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to