Marcus (aka @msykes) vulnerabilities
Published CVEs affecting Marcus (aka @msykes) products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-66640
Medium · 6.5
CWE-79 Aug 18, 2026
WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
CVE-2026-57713
High · 8.8
CWE-502 Jul 13, 2026
WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.
CVE-2026-22351
High · 7.5
CWE-862 Feb 20, 2026
WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through <= 1.6.
CVE-2026-24523
Medium · 5.3
CWE-497 Jan 23, 2026
WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.