CVE Feed

    Dashboard / CVE / CVE-2014-7138

    CVE-2014-7138

    Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.

    Published:Oct 16, 2014
    Last Modified:Apr 12, 2025
    EPS:Oct 16, 2014
    EPSS Score:0.00586
    CVSS Score:4.3

    Affected Products

    Vendor
    Google Calendar Events Project
    Product
    Google Calendar Events

    Exploits

    http://packetstormsecurity.com/files/128626/WordPress-Google-Calendar-Events-2.0.1-Cross-Site-Scripting.htmlhttps://www.htbridge.com/advisory/HTB23235http://packetstormsecurity.com/files/128626/WordPress-Google-Calendar-Events-2.0.1-Cross-Site-Scripting.htmlhttps://www.htbridge.com/advisory/HTB23235

    References

    http://packetstormsecurity.com/files/128626/WordPress-Google-Calendar-Events-2.0.1-Cross-Site-Scripting.html
    http://www.securityfocus.com/archive/1/533640/100/0/threaded
    http://www.securityfocus.com/bid/70370
    https://exchange.xforce.ibmcloud.com/vulnerabilities/96867
    https://github.com/pderksen/WP-Google-Calendar-Events/commit/a701ceeb410bdda9d96c9d3d12104630df5d5b43
    https://wordpress.org/plugins/google-calendar-events/changelog
    https://www.htbridge.com/advisory/HTB23235
    http://packetstormsecurity.com/files/128626/WordPress-Google-Calendar-Events-2.0.1-Cross-Site-Scripting.html
    http://www.securityfocus.com/archive/1/533640/100/0/threaded
    http://www.securityfocus.com/bid/70370
    https://exchange.xforce.ibmcloud.com/vulnerabilities/96867
    https://github.com/pderksen/WP-Google-Calendar-Events/commit/a701ceeb410bdda9d96c9d3d12104630df5d5b43
    https://wordpress.org/plugins/google-calendar-events/changelog
    https://www.htbridge.com/advisory/HTB23235

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High