The Events Calendar
by WordPress
Source repositories
CVEs (39)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-8275 | Cri | 0.68 | 9.8 | 0.50 | Sep 25, 2024 | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation… | ||
| CVE-2026-78006 | Cri | 0.64 | 9.8 | 0.01 | Sep 12, 2026 | The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires… | ||
| CVE-2026-78159 | Cri | 0.57 | 9.8 | 0.01 | Sep 12, 2026 | The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the… | ||
| CVE-2026-78265 | Cri | 0.57 | 9.8 | 0.01 | Aug 24, 2026 | Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions. | ||
| CVE-2026-49772 | Cri | 0.53 | 9.3 | 0.00 | Jun 16, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2. | ||
| CVE-2024-4180 | Cri | 0.52 | 9.1 | 0.02 | Jun 4, 2024 | The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. | ||
| CVE-2025-9807 | Hig | 0.49 | 7.5 | 0.00 | Sep 12, 2025 | The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.… | ||
| CVE-2024-8700 | Hig | 0.49 | 7.5 | 0.00 | May 15, 2025 | The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars. | ||
| CVE-2023-6203 | Hig | 0.49 | 7.5 | 0.01 | Dec 18, 2023 | The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request | ||
| CVE-2025-12197 | Hig | 0.43 | 7.5 | 0.17 | Nov 5, 2025 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it… | ||
| CVE-2026-3585 | Hig | 0.42 | 7.5 | 0.01 | Mar 10, 2026 | The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of… | ||
| CVE-2026-1922 | Med | 0.42 | 6.4 | 0.00 | Feb 10, 2026 | The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ecs-list-events` shortcode `message` attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on… | ||
| CVE-2024-12118 | Med | 0.42 | 6.4 | 0.00 | Jan 23, 2025 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it… | ||
| CVE-2024-1295 | Med | 0.42 | 6.5 | 0.00 | Jun 14, 2024 | The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.) | ||
| CVE-2024-6931 | Hig | 0.41 | 7.2 | 0.17 | Sep 27, 2024 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | ||
| CVE-2022-4320 | Med | 0.40 | 6.1 | 0.01 | Jan 16, 2023 | The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as… | ||
| CVE-2019-15109 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. | ||
| CVE-2026-97285 | Med | 0.35 | 5.4 | — | Sep 30, 2026 | Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. | ||
| CVE-2025-69352 | Med | 0.35 | 5.4 | 0.00 | Jan 6, 2026 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2. | ||
| CVE-2025-5144 | Med | 0.35 | 6.4 | 0.00 | Jun 11, 2025 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… |
- risk 0.68cvss 9.8epss 0.50
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…
- risk 0.64cvss 9.8epss 0.01
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires…
- risk 0.57cvss 9.8epss 0.01
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the…
- risk 0.57cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
- risk 0.53cvss 9.3epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
- risk 0.52cvss 9.1epss 0.02
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.
- risk 0.49cvss 7.5epss 0.00
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
- risk 0.49cvss 7.5epss 0.00
The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.
- risk 0.49cvss 7.5epss 0.01
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
- risk 0.43cvss 7.5epss 0.17
The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…
- risk 0.42cvss 7.5epss 0.01
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of…
- risk 0.42cvss 6.4epss 0.00
The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ecs-list-events` shortcode `message` attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on…
- risk 0.42cvss 6.4epss 0.00
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it…
- risk 0.42cvss 6.5epss 0.00
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)
- risk 0.41cvss 7.2epss 0.17
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
- risk 0.40cvss 6.1epss 0.01
The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as…
- risk 0.40cvss 6.1epss 0.01
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
- risk 0.35cvss 5.4epss —
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2.
- risk 0.35cvss 6.4epss 0.00
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
Page 1 of 2