CVE-2026-49772

PoC внедрения SQL в The Events Calendar CVE-2026-49772 Описание CVE-2026-49772 — это неаутентифицированная слепая SQL-инъекция в плагине WordPress The Events Calendar. Некорректный валидатор параметров REST validatecallback возвращает замыкание вместо проверки позволяет параметру order в...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Неаутентифицированная SQL-инъекция через meclistloadmore attsinclude / attsexclude Краткое описание...

CVE-2021-24145

CVE-2021-24145 Уязвимость загрузки файлов в WordPress, плагин Modern Events Calendar Lite для WordPress до версии 5.16.5 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 Порядок установки и запуска 1. Установка WordPress При установке выполните проброс портов в файле docker-compose.yml...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

WordPress Events Calendar <1.4.5 - Cross-Site Scripting

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting id: CVE-2021-24876 info: name: Registrations for The Events Calendar 2.7.5 - Authenticated Reflected...

WordPress Events Calendar 6.8.2.1 - Information Disclosure

The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication. id: CVE-2024-5333 info: name: WordPress Events Calendar 6.8.2.1 - Information Disclosu...

CVE-2026-78159

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-78159 CVE-2026-78159 The Events Calendar 6.17.3 — stellarwp WordPress용 The Events Calendar 플러그인은 parsearray 함수를 통해 6.17.3 이하의 모든 버전에서 원격 코드 실행Remote Code Execution에 취약합니다. 이는 위젯 'classes' 맵에 대한 검증이 불충분하기 때문에 발생하며, 일반 배열plain-array...

CVE-2026-78006-POC

CVE-2026-78006-POC CVE-2026-78006 の PoC The Events Calendar = 6.17.4 - 未認証の PHP オブジェクトインジェクションからリモートコード実行へ CONTACT 何か質問があれば telegram まで : @soldout0O 💙 プロジェクトを支援する 私の活動を評価していただけるなら、USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN を通じてプロジェクトを支援することをご検討ください。 The Events Calendar — 未認証の PHP...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 — это критическая уязвимость SQL-инъекции, обнаруженная в плагине WordPress The Events Calendar. Эта уязвимость затрагивает версии до 6.6.4 включительно. Проблема вызвана недостаточным экранированием параметра 'order' в функции tribehasnextevent. Поскольку ввод не...

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

On August 21 and August 22, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress plugin active on more than 600,000 websites. Both chains begin in the plugin's widget-rendering pipeli...

VulnCheck KEV: CVE-2026-78159

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

CVE-2026-78159

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

CVE-2026-78006

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

CVE-2026-78006

The Events Calendar WordPress plugin (≤ 6.17.4 ) is vulnerable to unauthenticated PHP Object Injection leading to Remote Code Execution . The root cause is insufficient protection in is_safe_widget_instance(), which is bypassed because PHP fires magic methods during pre-parse, combined with enabl...