morelmathieuj vulnerabilities

Products

• Scheduler Widget 1

Latest morelmathieuj CVEs

Newest publication first

1. CVE-2026-1987 Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification

   Published 2026-02-14

   Medium·CVSS 5.4 EPSS 0.37%

   The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the scheduler_widget_ajax_save_event() function lacking proper authorization checks and ownership verification when updating eve...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.