Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-08
The Events Calendar - Security Vulnerability (CVE-2026-95606)
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
PLUGIN
The Events Calendar
CVE-2026-95606
Risk Score
Threat Entry
Updated 2026-10-02
Events Calendar - Security Vulnerability (CVE-2026-84740)
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
PLUGIN
Events Calendar
CVE-2026-84740
Risk Score
Threat Entry
Updated 2026-09-30
The Events Calendar - Security Vulnerability (CVE-2026-97285)
Contributor Broken Access Control in The Events Calendar
PLUGIN
The Events Calendar
CVE-2026-97285
Risk Score
Threat Entry
Updated 2026-09-23
Events Calendar - Security Vulnerability (CVE-2026-84741)
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
PLUGIN
Events Calendar
CVE-2026-84741
Risk Score
Threat Entry
Updated 2026-09-23
Events Calendar - Security Vulnerability (CVE-2026-84743)
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
PLUGIN
Events Calendar
CVE-2026-84743
Risk Score
Threat Entry
Updated 2026-09-23
Events Calendar - Security Vulnerability (CVE-2026-84742)
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.
PLUGIN
Events Calendar
CVE-2026-84742
Risk Score
Threat Entry
Updated 2026-09-14
The Events Calendar - Security Vulnerability (CVE-2026-78159)
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has…
PLUGIN
The Events Calendar
CVE-2026-78159
Risk Score
Threat Entry
Updated 2026-09-14
The Events Calendar - Security Vulnerability (CVE-2026-78006)
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML,…
PLUGIN
The Events Calendar
CVE-2026-78006
Risk Score
Threat Entry
Updated 2026-09-08
Events Calendar - Security Vulnerability (CVE-2026-84745)
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
PLUGIN
Events Calendar
CVE-2026-84745
Risk Score
Threat Entry
Updated 2026-10-12
The Events Calendar - PHP Object Injection (CVE-2026-78265)
Unauthenticated PHP Object Injection in The Events Calendar
PLUGIN
The Events Calendar
CVE-2026-78265
Risk Score
Threat Entry
Updated 2026-07-27
Events Calendar - Security Vulnerability (CVE-2026-13390)
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
PLUGIN
Events Calendar
CVE-2026-13390
Risk Score
Threat Entry
Updated 2026-06-17
Events Calendar - Path Traversal (CVE-2026-3585)
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Events Calendar
CVE-2026-3585
Risk Score
Threat Entry
Updated 2026-06-17
Events Calendar - Security Vulnerability (CVE-2026-2694)
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.
PLUGIN
Events Calendar
CVE-2026-2694
Risk Score
Threat Entry
Updated 2026-06-17
The Events Calendar - Broken Access Control (CVE-2025-15043)
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with subscriber level access and above, to start, cancel, or revert the Custom Tables V1 database migration, including dropping the custom database tables entirely via the revert action.
PLUGIN
The Events Calendar
CVE-2025-15043
Risk Score
Threat Entry
Updated 2026-06-17
Events Calendar - Information Disclosure (CVE-2025-12192)
The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever "Yes, automatically share my system information with The Events Calendar support team" setting is enabled.
PLUGIN
Events Calendar
CVE-2025-12192
Risk Score
Threat Entry
Updated 2026-06-17
The Events Calendar - SQL Injection (CVE-2025-12197)
The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
The Events Calendar
CVE-2025-12197
Risk Score
Threat Entry
Updated 2026-06-17
The Events Calendar - Broken Access Control (CVE-2025-12175)
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate/view QR codes for them.
PLUGIN
The Events Calendar
CVE-2025-12175
Risk Score
Threat Entry
Updated 2026-06-17
The Events Calendar - Information Disclosure (CVE-2025-9808)
The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.
PLUGIN
The Events Calendar
CVE-2025-9808
Risk Score
Threat Entry
Updated 2026-06-17
Events Calendar - SQL Injection (CVE-2025-9807)
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Events Calendar
CVE-2025-9807
Risk Score
Threat Entry
Updated 2026-06-17
Events Calendar - Cross-Site Scripting (XSS) (CVE-2025-5144)
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Events Calendar
CVE-2025-5144
Risk Score