WordPress Events Calendar 6.8.2.1 - Information Disclosure

The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication. id: CVE-2024-5333 info: name: WordPress Events Calendar 6.8.2.1 - Information Disclosu...

CVE-2026-78006-POC

CVE-2026-78006-POC CVE-2026-78006 の PoC The Events Calendar = 6.17.4 - 未認証の PHP オブジェクトインジェクションからリモートコード実行へ CONTACT 何か質問があれば telegram まで : @soldout0O 💙 プロジェクトを支援する 私の活動を評価していただけるなら、USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN を通じてプロジェクトを支援することをご検討ください。 The Events Calendar — 未認証の PHP...

CVE-2026-49772

The Events Calendar SQLインジェクション CVE-2026-49772 PoC 説明 CVE-2026-49772 は、WordPressプラグイン The Events Calendar における 認証されていないブラインドSQLインジェクション です。壊れたRESTパラメータバリデータ（validatecallback が検証を行わずクロージャを返す）により、実験的な tec/v1 REST APIの order パラメータが、未サニタイズのままSQLの ORDER BY 句に到達します。 root@kitploit: GET...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 は、WordPress プラグイン The Events Calendar で発見された深刻な SQL インジェクションの脆弱性です。この脆弱性は、バージョン 6.6.4 以前に影響します。この問題は、tribehasnextevent 関数における 'order' パラメータのエスケープ処理が不十分であることに起因します。入力が適切にサニタイズされていないため、認証されていない攻撃者が悪意のある SQL クエリを追加し、データベースに保存されている機密情報にアクセスできる可能性があります。 1- Python をインストール:...

CVE-2026-84741

The Events Calendar WordPress plugin (versions 4.5 - 6.17.4 ) is vulnerable to an unauthenticated information disclosure. The application fails to verify the post status of linked records before embedding their details into a public REST API response. This oversight allows unauthenticated users t...

CVE-2026-84743

The Events Calendar WordPress plugin (versions 6.15.16.1 through 6.17.4 ) is vulnerable to an incorrect authorization flaw. The plugin fails to perform per-object capability checks on a specific family of REST write routes (specifically those using by-slug ). This allows users with low-privilege ...

CVE-2026-84742

The Events Calendar WordPress plugin, affecting versions 6.15.0 through 6.17.4 , contains an incorrect authorization vulnerability. The plugin fails to verify the necessary capabilities required to publish content when creating or updating entries via its REST API . This allows users with restric...

CVE-2026-84741 The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

CVE-2026-84742 The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

WordPress The Events Calendar plugin 6.15.0-6.17.4 - Contributor+ Content Publication vulnerability

Contributor+ Content Publication vulnerability discovered by Jashid Sany in WordPress Plugin The Events Calendar versions 6.15.0-6.17.4...

EUVD-2026-85038

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-84743 The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

WordPress The Events Calendar plugin 6.15.16.1-6.17.4 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability

Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.15.16.1-6.17.4...

WordPress The Events Calendar plugin 4.5-6.17.4 - Unauthenticated Non-Public Venue and Organizer Disclosure vulnerability

Unauthenticated Non-Public Venue and Organizer Disclosure vulnerability discovered by Kaveesha Nirmal in WordPress Plugin The Events Calendar versions 4.5-6.17.4...

CVE-2026-78159

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-78159 CVE-2026-78159 The Events Calendar 6.17.3 — stellarwp WordPress 用 The Events Calendar プラグインは、parsearray 関数を介して 6.17.3 以前のすべてのバージョンでリモートコード実行に対して脆弱です。これはウィジェットの 'classes' マップの検証が不十分であるため、プレーン配列のペイロードが issafewidgetinstance...

Exploit for CVE-2026-78159

abraxaslabs.tech · github.com/abraxas ·&...

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

On August 21 and August 22, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress plugin active on more than 600,000 websites. Both chains begin in the plugin's widget-rendering pipeli...

Exploit for CVE-2026-78006

CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar...

CVE-2026-78159

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...