The Events Calendar
Monthly
PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Blind SQL injection in The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) by Liquid Web / StellarWP allows remote attackers to inject malicious SQL via unsanitized input handled by the plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates a network-reachable, unauthenticated, low-complexity issue with a scope change and high confidentiality impact, putting it at 9.3 critical. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided in the input.
Stored cross-site scripting in the WordPress plugin The Events Calendar (versions through 6.18.1) lets an authenticated attacker with event-authoring privileges inject persistent JavaScript that executes when another user, such as an administrator, views the affected event page. Exploitation requires a low-privilege WordPress account (PR:L) and victim interaction (UI:R), and the flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit has been identified at time of analysis, and the issue was reported by Patchstack.
Unauthenticated shortcode injection in The Events Calendar WordPress plugin before 6.17.5.1 allows remote attackers to trigger any shortcode registered on a target site by submitting crafted data to an AJAX action that is merged into the rendering context without validation or sanitisation. No authentication, user interaction, or special configuration is required on default installs, but practical impact is limited to the set of shortcodes actually registered by WordPress core, the active theme, or installed plugins, and the assessed CVSS vector shows no availability impact and only low confidentiality and integrity impact. Public exploit code exists, but there is no CISA KEV confirmation of active exploitation; this is a moderate-priority issue rather than a critical one.
Broken access control in The Events Calendar WordPress plugin through version 6.17.5 allows an authenticated Contributor-level user to perform actions that should be reserved for higher-privileged roles, resulting in low integrity and availability impact with no confidentiality loss. The flaw is network-reachable with low attack complexity and no user interaction required, but it hinges on the attacker already holding a valid Contributor (or higher) account, so sites that do not allow open Contributor registration or that tightly control low-privilege accounts are substantially less exposed. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed severity is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - a genuine but low-to-moderate priority issue.
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. A public proof-of-concept is documented via WPScan, and a vendor patch (6.17.3.1) is available.
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggregator import records as failed and insert arbitrary content into a hidden comment. Public exploit code is available, and the vulnerability is automatable via the REST API, increasing the risk beyond the moderate CVSS score.
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Blind SQL injection in The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) by Liquid Web / StellarWP allows remote attackers to inject malicious SQL via unsanitized input handled by the plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates a network-reachable, unauthenticated, low-complexity issue with a scope change and high confidentiality impact, putting it at 9.3 critical. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided in the input.
Stored cross-site scripting in the WordPress plugin The Events Calendar (versions through 6.18.1) lets an authenticated attacker with event-authoring privileges inject persistent JavaScript that executes when another user, such as an administrator, views the affected event page. Exploitation requires a low-privilege WordPress account (PR:L) and victim interaction (UI:R), and the flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit has been identified at time of analysis, and the issue was reported by Patchstack.
Unauthenticated shortcode injection in The Events Calendar WordPress plugin before 6.17.5.1 allows remote attackers to trigger any shortcode registered on a target site by submitting crafted data to an AJAX action that is merged into the rendering context without validation or sanitisation. No authentication, user interaction, or special configuration is required on default installs, but practical impact is limited to the set of shortcodes actually registered by WordPress core, the active theme, or installed plugins, and the assessed CVSS vector shows no availability impact and only low confidentiality and integrity impact. Public exploit code exists, but there is no CISA KEV confirmation of active exploitation; this is a moderate-priority issue rather than a critical one.
Broken access control in The Events Calendar WordPress plugin through version 6.17.5 allows an authenticated Contributor-level user to perform actions that should be reserved for higher-privileged roles, resulting in low integrity and availability impact with no confidentiality loss. The flaw is network-reachable with low attack complexity and no user interaction required, but it hinges on the attacker already holding a valid Contributor (or higher) account, so sites that do not allow open Contributor registration or that tightly control low-privilege accounts are substantially less exposed. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed severity is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - a genuine but low-to-moderate priority issue.
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and private records from all users - through its public REST API archive endpoints to any contributor-level authenticated user. The plugin fails to enforce WordPress's standard post-status visibility controls on its custom REST routes, allowing a low-privilege account holder to enumerate and read the full body of every non-public record site-wide, bypassing intended access controls. A public proof-of-concept is documented via WPScan, and a vendor patch (6.17.3.1) is available.
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggregator import records as failed and insert arbitrary content into a hidden comment. Public exploit code is available, and the vulnerability is automatable via the REST API, increasing the risk beyond the moderate CVSS score.
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.