What is the CVSS score of CVE-2026-84740?

CVE-2026-84740 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-84740?

Yes, a public proof-of-concept exploit is available for CVE-2026-84740. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-84740?

Yes, a patch is available for CVE-2026-84740. Update the affected software to the latest version immediately.

The Events Calendar CVE-2026-84740

EUVD-2026-91210 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-10-02 WPScan

GHSA-4c37-j68q-cmxj

WordPress RCE The Events Calendar Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Unauthenticated AJAX endpoint gives AV:N/AC:L/PR:N/UI:N; impact limited to registered-shortcode abuse yields C:L/I:L/A:N with scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Oct 02, 2026 - 08:01 EUVD

Analysis Generated

Oct 02, 2026 - 07:35 vuln.today

CVE Published

Oct 02, 2026 - 06:56 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

AnalysisAI

Unauthenticated shortcode injection in The Events Calendar WordPress plugin before 6.17.5.1 allows remote attackers to trigger any shortcode registered on a target site by submitting crafted data to an AJAX action that is merged into the rendering context without validation or sanitisation. No authentication, user interaction, or special configuration is required on default installs, but practical impact is limited to the set of shortcodes actually registered by WordPress core, the active theme, or installed plugins, and the assessed CVSS vector shows no availability impact and only low confidentiality and integrity impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication, user interaction, or special configuration is required: the vulnerable AJAX action is reachable by unauthenticated users against default installs of The Events Calendar prior to 6.17.5.1, and the plugin merges submitted data into its rendering context without validation or sanitisation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate-priority issue rather than a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade The Events Calendar to 6.17.5.1 or later; vendor-released patch: 6.17.5.1, per the WPScan advisory at https://wpscan.com/vulnerability/3381a51e-beaa-4420-a33b-6a68612a2e8a/. … Detailed patch versions, workarounds, and compensating controls in full report.