CVE-2022-2846

MEDIUM

Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-2846 has a selected CVSS score of 4.3 (medium); EIP currently links 1 catalogued exploit.

Description

The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 15, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Calendar Event Multi View

CVE List1.4.07 to < 1.4.07affected

Proofs of concept

1

Catalogued exploits

ExploitDBCalendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)ExploitDB exploitby Mostafa FarzanehNot analyzed1 file
ExploitDB
PoC details

References

4