874 matches found
WordPress Events Calendar <1.4.5 - Cross-Site Scripting
WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...
The Events Calendar < 6.4.0.1 - Cross-site Scripting
The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...
WordPress Events Calendar 6.8.2.1 - Information Disclosure
The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication. id: CVE-2024-5333 info: name: WordPress Events Calendar 6.8.2.1 - Information Disclosu...
Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting id: CVE-2021-24876 info: name: Registrations for The Events Calendar 2.7.5 - Authenticated Reflected...
CVE-2021-24145
CVE-2021-24145 WordPress File Upload Vulnerability, Modern Events Calendar Lite WordPress plugin before 5.16.5 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 Installation and Execution Steps 1. WordPress Installation When proceeding with installation, please perform port forwarding in the...
WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure
WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...
WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...
WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...
CVE-2026-11349
Modern Events Calendar Lite = 7.33.0 — Inyección SQL no autenticada mediante meclistloadmore attsinclude / attsexclude Resumen...
CVE-2026-49772
The Events Calendar SQL Injection CVE-2026-49772 PoC Description CVE-2026-49772 is an unauthenticated blind SQL injection in the WordPress plugin The Events Calendar. A broken REST parameter validator validatecallback returns a closure instead of validating lets the order parameter on the...
CVE-2024-8275
CVE-2024-8275 CVE-2024-8275 è una vulnerabilità critica di SQL injection scoperta nel plugin WordPress The Events Calendar. Questa vulnerabilità colpisce le versioni fino alla 6.6.4 inclusa. Il problema deriva da un escaping insufficiente del parametro 'order' nella funzione tribehasnextevent...
EUVD-2026-65172
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
CVE-2026-78265
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
CVE-2026-78265
The Events Calendar WordPress plugin versions
CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
PT-2026-81058
Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to...
CVE-2026-73339
Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...
CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...
CVE-2026-73339
Affected product: Modern Events Calendar plugin for WordPress. Root cause: SQL injection vulnerability exploitable without authentication in versions below 7.35.0. Impact: CVSS 9.3 (CRITICAL), network-exploitable with no privileges or user interaction, enabling high confidentiality impact. Remedi...