These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, potentially lea [truncated]
A SQL Injection vulnerability exists in the WordPress CP Multi View Event Calendar plugin versions up to 1.4.41. This issue allows for potential SQL Injection attacks, which could lead to unauthorized access or manipulation of database information. The vulnerability has been identified in the CVE Program record and the National Vulnerability Database (NVD).
The Calculated Fields Form plugin for WordPress has a Reflected DOM-Based Cross-Site Scripting vulnerability. This CVE was published on 2026-10-03T06:16:41.413Z and was last modified on 2026-10-03T16:16:34.220Z. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. [truncated]
CVE-2026-100184 debrief: The Calculated Fields Form plugin for WordPress has a Reflected DOM-Based Cross-Site Scripting vulnerability. This CVE was published on 2026-10-01T09:17:07.423Z and was last modified on 2026-10-03T16:16:31.130Z. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action su [truncated]
The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and including, 1.2.6. This vulnerability allows authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability has a CVSS score of [truncated]
The Appointment Booking Calendar plugin for WordPress has a Sensitive Information Exposure vulnerability (CVE-2026-12111, CVSS Score: 4.3) in versions up to and including 1.4.01. This vulnerability allows authenticated attackers with Contributor-level access or above to extract customer booking information from any calendar managed by the plugin. The issue arises from insufficient authorization and missin [truncated]
A SQL injection vulnerability exists in the WP Time Slots Booking Form plugin versions up to 1.2.50. This issue allows a subscriber to inject malicious SQL code. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity.
CVE-2026-40791 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in the WP Time Slots Booking Form plugin versions up to 1.2.46. Defenders should assess exposure, prioritize remediation, and verify inventory for this plugin.
A Missing Authorization vulnerability in the Sell Downloads plugin for WordPress, versions from n/a through 1.1.12, allows attackers to exploit incorrectly configured access control security levels. This issue has a CVSS score of 7.5 and is considered HIGH severity. The vulnerability affects WordPress installations with the Sell Downloads plugin, potentially allowing unauthorized access or disruption of p [truncated]
