CVE-2024-8275

The Events Calendar (WordPress plugin) is affected by CVE-2024-8275: an unauthenticated SQL injection via the order parameter in tribe_has_next_event() that affects all versions up to 6.6.4. The issue stems from insufficient escaping of user input and inadequate SQL query preparation, allowing an...

CVE-2024-5333

The Events Calendar WordPress plugin (versions prior to 6.8.2.1 ) contains a vulnerability where missing access checks in the REST API allow unauthenticated users to access information regarding password-protected events . This flaw can lead to sensitive information disclosure. Remediation involv...

CVE-2025-5144

CVE-2025-5144 affects The Events Calendar plugin for WordPress. The issue is a DOM-based Stored Cross-Site Scripting vulnerability via the data-date-* parameters in all versions up to 6.13.2, caused by insufficient input sanitization and output escaping. Exploitation requires authentication at Co...

CVE-2023-6557

CVE-2023-6557 concerns The Events Calendar plugin for WordPress. Affected: The Events Calendar versions up to and including 6.2.8.2. Root cause: a route function hooked into wp_ajax_nopriv_tribe_dropdown allows unauthenticated access, enabling potential exposure of sensitive data such as post tit...

CVE-2024-4180

The Events Calendar WordPress plugin (versions before 6.4.0.1 ) is vulnerable to stored Cross-site Scripting (XSS) . The root cause is the improper sanitization of user-submitted content when the plugin renders certain views via AJAX . Attackers can exploit this to execute arbitrary scripts in th...

CVE-2024-6931

The CVE pertains to WordPress The Events Calendar plugin. Affected: The Events Calendar plugin for WordPress, versions up to and including 6.6.3. Root cause: Stored Cross-Site Scripting via the RSVP name field due to insufficient input sanitization and output escaping. Impact: unauthenticated att...

CVE-2023-6203

The CVE concerns The Events Calendar WordPress plugin, specifically versions prior to 6.2.8.1. The vulnerability is an information disclosure where unauthenticated users can read the content of password-protected posts via a crafted request. The root cause is described across multiple sources as ...

CVE-2019-15109

The CVE-2019-15109 entry relates to WordPress plugin The Events Calendar (prior to version 4.8.2) and is caused by an XSS flaw in the tribe_paged URL parameter. Exploitation could enable client-side code execution. Affected software is the Events Calendar plugin for WordPress; vulnerable componen...

CVE-2024-8493

The Events Calendar WordPress plugin (versions prior to 6.6.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape specific settings within the plugin. This flaw allows high-privilege users, such as administrators , to perform XSS at...