CVE-2024-0855: spiffy calendar — Exploit

Description

The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.

Is your site exposed to CVE-2024-0855?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Products

Vendor	Product	Versions
spiffyplugins	spiffy_calendar	< 4.9.9

References

Exploits

https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/ https://wpscan.com/vulnerability/5d5da91e-3f34-46b0-8db2-354a88bdf934/

Frequently Asked Questions

What is CVE-2024-0855? +

The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2024-0855? +

CVE-2024-0855 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-0855? +

CVE-2024-0855 affects products from spiffyplugins, specifically: spiffy_calendar. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-0855? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-38692 7.6

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL …

CVE-2024-45458 7.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This …

CVE-2024-45457 6.5

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This …

CVE-2024-49695 6.5

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored …

CVE-2024-35651 6.5

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows …

CVE-2024-30528 5.4

Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.

CVE-2024-0855