Skip to contentUnknown The Events Calendar vulnerabilities
- stellarwp the events calendarThe Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' ParameterCVE-2026-847406.5 Medium
- stellarwp the events calendarThe Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST RoutesCVE-2026-847433.8 Low
- stellarwp the events calendarThe Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST APICVE-2026-847422.7 Low
- stellarwp the events calendarThe Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST APICVE-2026-847415.3 Medium
- stellarwp the events calendarThe Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST APICVE-2026-847452.7 Low
- stellarwp the events calendarThe Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status ManipulationCVE-2026-133905.3 Medium
- roundupwp registrations for the events calendar – event registration pluginRegistrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' ParameterCVE-2026-131196.5 Medium
- stellarwp the events calendarThe Events Calendar < 6.6.4 - Admin+ Stored XSSCVE-2024-84934.8 Medium
- roundupwp registrations for the events calendarRegistrations for The Events Calendar < 2.13.4 - Admin+ Stored XSSCVE-2024-107036.1 Medium
- stellarwp the events calendarThe Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event DisclosureCVE-2024-53335.3 Medium
- roundup wp registrations for the events calendarWordPress Registrations for the Events Calendar plugin <= 2.12.1 - Broken Access Control vulnerabilityCVE-2024-431436.4 Medium
- roundupwp registrations for the events calendarRegistrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSSCVE-2024-79829.6 Critical
- roundup wp registrations for the events calendarWordPress Registrations for the Events Calendar plugin <= 2.12.2 - SQL Injection vulnerabilityCVE-2024-396388.5 High
- stellarwp the events calendar, unknown events-calendar-pro, theeventscalendar events calendar pro +2 moreThe Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events AccessCVE-2024-12956.5 Medium
- stellarwp the events calendarThe Events Calendar < 6.4.0.1 - Reflected XSSCVE-2024-41809.1 Critical
- stellarwp the events calendarThe Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post ReadCVE-2023-62037.5 High
- roundupwp registrations for the events calendar, unknown registrations for the events calendar – event registration plugin +1 moreRegistrations for the Events Calendar < 2.7.10 - Reflected Cross-Site ScriptingCVE-2021-250836.1 Medium
- roundupwp registrations for the events calendar, unknown registrations for the events calendar – event registration plugin +1 moreRegistrations for the Events Calendar < 2.7.6 - Unauthenticated SQL InjectionCVE-2021-249439.8 Critical
- roundupwp registrations for the events calendar, unknown registrations for the events calendar – event registration plugin +1 moreRegistrations for The Events Calendar < 2.7.5 - Reflected Cross-Site ScriptingCVE-2021-248766.1 Medium