Unknown The Events Calendar vulnerabilities
11 vulnerabilities
Known vulnerabilities in Unknown The Events Calendar, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-1295trithe_events_calendar+4
EPSS score0.46%
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)CVE-2024-4180stellarwpthe_events_calendar+2EPSS score2.08%
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.CVE-2024-5333stellarwpthe_events_calendar+2EPSS score1.12%
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.CVE-2024-8493stellarwpthe_events_calendar+2EPSS score0.36%
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).CVE-2026-13390unknownthe events calendar+1EPSS score0.30%
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.CVE-2026-84743unknownthe events calendar+1EPSS score0.23%
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.CVE-2026-84742unknownthe events calendar+1EPSS score0.23%
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.CVE-2026-84741unknownthe events calendar+1EPSS score0.25%
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.CVE-2026-84745unknownthe events calendar+1EPSS score0.32%
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.CVE-2026-84740unknownthe events calendar+1EPSS score0.22%
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.CVE-2023-6203stellarwpthe_events_calendar+2EPSS score0.78%
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request