CVE-2026-16536: The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticat
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-16536
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-16536 | coverage & exploitation status | NVD · CVE.org |
More from NVD Recent CVEs
- highCVE-2026-67243: freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerab…2026-08-04
- unknownCVE-2026-18759: The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based i…2026-08-04
- highCVE-2026-18755: A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write acc…2026-08-04
- criticalCVE-2026-18754: The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web…2026-08-04
- criticalCVE-2026-18753: The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web…2026-08-04