CVE-2025-31572: WordPress Multi Days Events and Multi Events in One Day Calendar plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

4.3 CVSS

Description

Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar allows Cross Site Request Forgery. This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through 1.1.3.

Classification

CVE ID: CVE-2025-31572

CVSS Base Severity: MEDIUM

CVSS Base Score: 4.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Problem Types

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Vendor: v20202020

Product: Multi Days Events and Multi Events in One Day Calendar

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.02% (probability of being exploited)

EPSS Percentile: 2.18% (scored less or equal to compared to others)

EPSS Date: 2025-04-21 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-31572
https://patchstack.com/database/wordpress/plugin/dragon-calendar-free-version/vulnerability/wordpress-multi-days-events-and-multi-events-in-one-day-calendar-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Timeline