The Events Calendar Security Vulnerabilities and Issues — The Events Calendar CVE List

Lucene search

StellarwpThe Events Calendar

9 matches found

CVE•added 2024/09/25 5:15 a.m.•89 views

CVE-2024-8275

The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

9.8CVSS9.8AI score0.75005EPSS

CVE•added 2024/12/16 6:15 a.m.•86 views

CVE-2024-5333

The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.

5.3CVSS6.5AI score0.0003EPSS

CVE•added 2024/02/05 10:15 p.m.•53 views

CVE-2023-6557

The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data inc...

5.3CVSS5.1AI score0.00694EPSS

CVE•added 2025/06/11 1:15 p.m.•49 views

CVE-2025-5144

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-le...

6.4CVSS5.7AI score0.00044EPSS

CVE•added 2023/12/18 8:15 p.m.•43 views

CVE-2023-6203

The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request

7.5CVSS7.5AI score0.00766EPSS

CVE•added 2024/09/27 9:15 a.m.•38 views

CVE-2024-6931

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

7.2CVSS5.9AI score0.01558EPSS

CVE•added 2019/08/21 12:15 p.m.•35 views

CVE-2019-15109

The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.

6.1CVSS6AI score0.00223EPSS

CVE•added 2024/06/04 6:15 a.m.•30 views

CVE-2024-4180

The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.

9.1CVSS7.1AI score0.00997EPSS

CVE•added 2025/05/15 8:15 p.m.•14 views

CVE-2024-8493

The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

4.8CVSS5.7AI score0.00039EPSS