Skip to contentStellarwp The Events Calendar vulnerabilities
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1234646.5 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerabilityCVE-2026-1234695.3 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerabilityCVE-2026-1193675.4 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1193696.5 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerabilityCVE-2026-1193685.3 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1193706.5 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1109036.5 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerabilityCVE-2026-956069.8 Critical
- stellarwp the events calendarThe Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' ParameterCVE-2026-847406.5 Medium
- nexcess the events calendarWordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerabilityCVE-2026-972855.4 Medium
- stellarwp the events calendarThe Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST RoutesCVE-2026-847433.8 Low
- stellarwp the events calendarThe Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST APICVE-2026-847422.7 Low
- stellarwp the events calendarThe Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST APICVE-2026-847415.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable InvocationCVE-2026-78159Public exploit9.8 Critical
- stellarwp the events calendarThe Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code ExecutionCVE-2026-78006Public exploit9.8 Critical
- stellarwp the events calendarThe Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST APICVE-2026-847452.7 Low
- nexcess the events calendarWordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerabilityCVE-2026-782659.8 Critical
- stellarwp the events calendarThe Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status ManipulationCVE-2026-133905.3 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerabilityCVE-2026-49772Public exploit9.3 Critical
- stellarwp the events calendarThe Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_importCVE-2026-35857.5 High
- stellarwp the events calendarThe Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST APICVE-2026-26945.4 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration ControlCVE-2025-150435.4 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerabilityCVE-2025-693525.4 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information ExposureCVE-2025-121925.3 Medium
- stellarwp the events calendarThe Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via sCVE-2025-12197EPSS 18.2%7.5 High
- stellarwp the events calendarThe Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code ExposureCVE-2025-121754.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information DisclosureCVE-2025-98085.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.1 - Unauthenticated SQL InjectionCVE-2025-98077.5 High
- stellarwp the events calendarThe Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingCVE-2025-51446.4 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control VulnerabilityCVE-2025-482465.4 Medium
- stellarwp the events calendarThe Events Calendar < 6.6.4 - Admin+ Stored XSSCVE-2024-84934.8 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2025-245375.4 Medium
- stellarwp the events calendarThe Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-121186.4 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-375184.3 Medium
- stellarwp the events calendarThe Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event DisclosureCVE-2024-53335.3 Medium
- stellarwp the events calendar, the events calendar events calendar +1 moreWordPress The Events Calendar plugin <= 6.1.2.2 - Broken Access Control vulnerabilityCVE-2023-357775.3 Medium
- 5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 moreFreemius SDK <= 2.4.2 - Missing Authorization ChecksCVE-2022-49746.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-6931EPSS 16.7%7.2 High
- stellarwp the events calendarThe Events Calendar <= 6.6.4 - Unauthenticated SQL InjectionCVE-2024-8275Public exploitEPSS 49.9%9.8 Critical
- stellarwp the events calendar, unknown events-calendar-pro, theeventscalendar events calendar pro +2 moreThe Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events AccessCVE-2024-12956.5 Medium
- stellarwp the events calendarThe Events Calendar < 6.4.0.1 - Reflected XSSCVE-2024-41809.1 Critical
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-314334.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information ExposureCVE-2023-65575.3 Medium
- stellarwp the events calendarThe Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post ReadCVE-2023-62037.5 High