Vr Calendar
Approved changes feed: RSS · Atom
cpe:2.3:a:vr_calendar_project:vr_calendar:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Vr Calendar Project (7774b47c-5d59-5ca0-9507-b8daa4079d4b) |
|---|---|
| Product | Vr Calendar (bd8f2955-72b0-52d4-ab9e-e22f0169b453) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wp-plugins/vr-calendar-sync |
purl2cpe | 2026-06-01 10:14:09.119580 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-5936 |
vulnerable | 2026-06-08 07:37:26.106566 |
VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync
MEDIUM (4.3)
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-06-27T07:22:23.312Z
Updated: 2026-04-08T16:54:29.411Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3852 |
vulnerable | 2026-06-08 05:48:22.465201 |
VR Calendar <= 2.3.3 - Cross-Site Request Forgery
HIGH (8.8)
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the plugin settings, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2022-11-03T17:15:11.490Z
Updated: 2026-04-08T17:13:53.083Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2314 |
vulnerable | 2026-06-08 05:43:35.287361 |
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.
Published: 2022-08-15T08:36:40.000Z
Updated: 2024-08-03T00:32:09.676Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.