WORDFENCE-22cb2bc4-ddf1-4e23-af1c-4f59ff88e9e1
high
📛 Threat Title
Spider Calendar < 1.1.3 - Multiple Vulnerabilities
Description
The Spider Calendar plugin for WordPress is vulnerable to generic SQL Injection, Cross-Site Scripting, and Parameter Pollution via several parameters in versions up to, and including,1.1.2 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, and to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Affected software — plugin: spider-calendar (affected: [*, 1.1.3)). CVSS 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (2)
Remediations (1)
-
Wordfence remediation: spider-calendarWordfence
Update to version 1.1.3, or a newer patched version
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.