Medium · 5.4 CVE-2022-25599 EUVD-2022-30259GHSA-w7h5-gm2r-5xj4

WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability

Published Feb 21, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).

Vendor	Product	Affected	Fixed
Spiffy Plugins	Spiffy Calendar (WordPress plugin)	<= 4.9.0 – ≤ 4.9.0	—