GCVE - cpe:2.3:a:total-soft:event_calendar:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:total-soft:event_calendar:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Total Soft (`1ac4e436-ee7f-52c2-b8fd-45cece1d4262`)
Product	Event Calendar (`e2f7e093-ea45-51aa-b6c0-28a87e56c3c5`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/wpplugins/calendar-event`	purl2cpe	2026-06-01 10:16:25.218249

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-8700`	vulnerable	2026-06-08 07:00:25.422722	Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars. Published: 2025-05-15T20:07:17.831Z Updated: 2025-08-27T12:00:57.959Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-38067`	vulnerable	2026-06-08 05:47:14.520605	WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability MEDIUM (6.5) Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. Published: 2022-09-09T14:39:55.482Z Updated: 2026-04-28T16:07:46.692Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/calendar-event/wordpress-event-calendar-calendar-plugin-1-4-6-unauthenticated-event-deletion-vulnerability/_s_id=cve https://wordpress.org/plugins/calendar-event/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-36390`	vulnerable	2026-06-08 05:46:07.240553	WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability MEDIUM (4.1) Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. Published: 2022-09-21T19:03:45.225Z Updated: 2026-04-28T16:07:45.893Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/calendar-event/wordpress-event-calendar-calendar-plugin-1-4-6-authenticated-reflected-cross-site-scripting-xss-vulnerability https://wordpress.org/plugins/calendar-event/#developers	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.