TE
Product
The Events Calendar
25
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 4Medium 17Low 0
Watch
Add The Events Calendar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-78159 | 9.8 | Sep 12 | The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation Affected: through 6.17.3 |
| CVE-2026-78006 | 9.8 | Sep 12 | The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution Affected: through 6.17.4 |
| CVE-2024-8275 | 9.8 | Sep 25 | The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection Affected: through 6.6.4 |
| CVE-2024-4180 | 9.1 | Jun 4 | The Events Calendar < 6.4.0.1 - Reflected XSS Affected: before 6.4.0.1 |
| CVE-2026-3585 | 7.5 | Mar 10 | The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import Affected: through 6.15.17 |
| CVE-2025-12197 | 7.5 | Nov 5 | The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s Affected: 6.15.1.1 through 6.15.9 |
| CVE-2025-9807 | 7.5 | Sep 12 | The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection Affected: through 6.15.1 |
| CVE-2023-6203 | 7.5 | Dec 18 | The Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read Affected: before 6.2.8.1 |
| CVE-2024-6931 | 6.1 | Sep 27 | The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting Affected: through 6.6.3 |
| CVE-2019-15109 | 6.1 | Aug 21 | The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter Affected: before 4.8.2 |
| CVE-2026-2694 | 5.4 | Feb 25 | The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API Affected: through 6.15.16 |
| CVE-2025-15043 | 5.4 | Jan 20 | The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control Affected: through 6.15.13 |
| CVE-2025-69352 | 5.4 | Jan 6 | WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability Affected: through 6.15.12.2 |
| CVE-2025-5144 | 5.4 | Jun 11 | The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Affected: through 6.13.2 |
| CVE-2025-48246 | 5.4 | May 19 | WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability Affected: through 6.11.2.1 |
| CVE-2025-24537 | 5.4 | Jan 27 | WordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 6.7.0 |
| CVE-2024-12118 | 5.4 | Jan 23 | The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 6.9.0 |
| CVE-2025-12192 | 5.3 | Nov 5 | The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure Affected: through 6.15.9 |
| CVE-2025-9808 | 5.3 | Sep 16 | The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure Affected: through 6.15.2 |
| CVE-2024-5333 | 5.3 | Dec 16 | The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure Affected: before 6.8.2.1 |
| CVE-2023-6557 | 5.3 | Feb 5 | The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure Affected: through 6.2.8.2 |
| CVE-2024-8493 | 4.8 | May 15 | The Events Calendar < 6.6.4 - Admin+ Stored XSS Affected: before 6.6.4 |
| CVE-2025-12175 | 4.3 | Oct 31 | The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure Affected: through 6.15.9 |
| CVE-2024-37518 | 4.3 | Jan 2 | WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 6.5.1.4 |
| CVE-2024-31433 | 4.3 | Apr 15 | WordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 6.3.0 |
Showing 25