CVE-2025-5936

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-593609.8The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allow CVE-2025-593619.8The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allow CVE-2025-593624.0Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.CVE-2025-593637.7In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only CVE-2025-593645.3The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/CVE-2025-593656.9A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability CVE-2025-593669.2An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba func CVE-2025-593679.8An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized ac CVE-2025-593686.0An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a cra CVE-2025-593695.9A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentiall CVE-2025-59374.3The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Reques CVE-2025-593707.5A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potent