Simple Google Calendar Outlook Events Widget
Monthly
Server-Side Request Forgery in Simple Google Calendar Outlook Events Widget WordPress plugin (all versions before 3.1.0) permits unauthenticated remote attackers to supply arbitrary URLs that the server fetches without validation, potentially exposing responses from internal services. The plugin is confirmed vulnerable by WPScan and a public exploit exists, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation despite the available POC. This vulnerability is not listed in CISA KEV at time of analysis.
Server-Side Request Forgery in Simple Google Calendar Outlook Events Widget WordPress plugin (all versions before 3.1.0) permits unauthenticated remote attackers to supply arbitrary URLs that the server fetches without validation, potentially exposing responses from internal services. The plugin is confirmed vulnerable by WPScan and a public exploit exists, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation despite the available POC. This vulnerability is not listed in CISA KEV at time of analysis.