CVE-2026-39532: Deserialization of Untrusted Data

Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...

CVE-2026-11616: Improper Privilege Management

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajaxayiaction handler only applying striptagsescsql — with no allow-list — to the attacker-controlled $POST'type' and $POST'postid' values...

PT-2025-9478

Name of the Vulnerable Software and Affected Versions Events Calendar for GeoDirectory versions 2.3.14 and earlier Description The issue is related to the Deserialization of Untrusted Data, which allows Object Injection. Recommendations For versions 2.3.14 and earlier, update to a version later...

CVE-2025-26967: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through = 2.3.14...