The Simple calendar for Elementor plugin (versions up to 1.6.5) contains a CSRF vulnerability (CVE-2025-47542) that enables attackers to induce authenticated users to execute unwanted actions without their consent. The vulnerability is network exploitable with low attack complexity and requires user interaction. It does not require privileges and affects the integrity of the application minimally. No patch or official fix information is provided in the available data.

The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user, potentially altering data or settings within the affected plugin. There is no impact on confidentiality or availability reported. The integrity impact is limited, and no known exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting access to trusted users. Monitor vendor channels for updates regarding patches or official mitigations.