CVE-2024-3756

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	MF Gig Calendar	<= 1.2.1
mf_gig_calendar_project	mf_gig_calendar	<= 1.2.1

References

https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/Exploit, Third Party Advisory

Timeline

Published: May 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-375608.0Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from CVE-2024-375615.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jamie Bergen Plugin Notes Plus CVE-2024-375625.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BracketSpace Simple Post Notes CVE-2024-375636.5Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TOCHAT.BE allows Stored XSS.Thi CVE-2024-375648.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.Th CVE-2024-375655.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemeGUM Gum Elementor Addon all CVE-2024-375669.8Infoblox NIOS through 8.6.4 has Improper Authentication for Grids.CVE-2024-375679.1Infoblox NIOS through 8.6.4 has Improper Access Control for Grids.CVE-2024-375687.5lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMA CVE-2024-375698.8An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the CVE-2024-37575.5in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through integer overflow.CVE-2024-375708.8On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path param