What’s Vulnerable › Products
stellarwp The Events Calendar vulnerabilities
31 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 22 published in the last 12 months.
Check whether your stellarwp The Events Calendar version is affected
Latest stellarwp The Events Calendar vulnerabilities
- CVE-2026-84740 — The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter (CVSS 6.5)
- CVE-2026-84743 — The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes (CVSS 3.8)
- CVE-2026-84742 — The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API (CVSS 2.7)
- CVE-2026-84741 — The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API (CVSS 5.3)
- CVE-2026-78159 — The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation (CVSS 9.8)
- CVE-2026-78006 — The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution (CVSS 9.8)
- CVE-2026-84745 — The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API (CVSS 2.7)
- CVE-2026-13390 — The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation (CVSS 5.3)
- CVE-2026-3585 — The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import (CVSS 7.5)
- CVE-2026-2694 — The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API (CVSS 5.4)
- CVE-2025-15043 — The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control (CVSS 5.4)
- CVE-2025-69352 — WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability (CVSS 5.4)
- CVE-2025-12192 — The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- CVE-2025-12197 — The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s (CVSS 7.5)
- CVE-2025-12175 — The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure (CVSS 4.3)
- CVE-2025-9808 — The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure (CVSS 5.3)
- CVE-2025-9807 — The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection (CVSS 7.5)
- CVE-2025-5144 — The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2025-48246 — WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability (CVSS 5.4)
- CVE-2024-8493 — The Events Calendar < 6.6.4 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2025-24537 — WordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- CVE-2024-37518 — WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- CVE-2024-5333 — The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure (CVSS 5.3)
- CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- CVE-2024-6931 — The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)