WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Erik Debye in WordPress Plugin The Events Calendar versions = 6.17.5...

WordPress Events Calendar <1.4.5 - Cross-Site Scripting

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

WordPress Events Calendar 6.8.2.1 - Information Disclosure

The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication. id: CVE-2024-5333 info: name: WordPress Events Calendar 6.8.2.1 - Information Disclosu...

Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting id: CVE-2021-24876 info: name: Registrations for The Events Calendar 2.7.5 - Authenticated Reflected...

CVE-2021-24145

CVE-2021-24145 WordPress文件上传漏洞，Modern Events Calendar Lite WordPress插件5.16.5之前版本 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 安装与运行顺序 1. WordPress安装 进行安装时，请从docker-compose.yml文件中进行端口转发。 $ docker-compose up 2. WordPress初始化及插件安装 前往 http://web服务器ip:端口/ 进行基本安装。 前往 插件 - 添加新 - 上传插件。 上传并安装...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Inyección SQL no autenticada mediante meclistloadmore attsinclude / attsexclude Resumen Detalle| Valor ---|--- Plugin| Modern Events Calendar Lite Slug| modern-events-calendar-lite Autor| Webnus Afectado| = 7.33.0 la versión Lite actual distribuida por el...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

CVE-2026-78159

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-78159 CVE-2026-78159 The Events Calendar 6.17.3 — stellarwp El plugin The Events Calendar para WordPress es vulnerable a ejecución remota de código en todas las versiones hasta la 6.17.3, inclusive, a través de la función parsearray...

CVE-2026-78006-POC

CVE-2026-78006-POC POC para CVE-2026-78006 The Events Calendar = 6.17.4 - Inyección de Objetos PHP No Autenticada a Ejecución Remota de Código CONTACTO telegram para cualquier consulta : @soldout0O 💙 Apoya el Proyecto Si aprecias mi trabajo, considera apoyar el proyecto vía USDT TRC20:...

CVE-2026-49772

Prueba de Concepto PoC de Inyección SQL en The Events Calendar CVE-2026-49772 Descripción CVE-2026-49772 es una inyección SQL ciega no autenticada en el plugin de WordPress The Events Calendar. Un validador de parámetros REST defectuoso validatecallback devuelve un closure en lugar de validar...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 es una vulnerabilidad crítica de inyección SQL descubierta en el plugin de WordPress The Events Calendar. Esta vulnerabilidad afecta a versiones hasta la 6.6.4 inclusive. El problema surge por un escape insuficiente del parámetro 'order' en la función tribehasnextevent...

CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-84743

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

CVE-2026-84742

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

CVE-2026-84743

The Events Calendar WordPress plugin (versions 6.15.16.1 through 6.17.4 ) is vulnerable to an incorrect authorization flaw. The plugin fails to perform per-object capability checks on a specific family of REST write routes (specifically those using by-slug ). This allows users with low-privilege ...

CVE-2026-84742

The Events Calendar WordPress plugin, affecting versions 6.15.0 through 6.17.4 , contains an incorrect authorization vulnerability. The plugin fails to verify the necessary capabilities required to publish content when creating or updating entries via its REST API . This allows users with restric...

CVE-2026-84741

The Events Calendar WordPress plugin (versions 4.5 - 6.17.4 ) is vulnerable to an unauthenticated information disclosure. The application fails to verify the post status of linked records before embedding their details into a public REST API response. This oversight allows unauthenticated users t...