WordPress plugin
The Events Calendar security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High7
- Medium37
- Low0
All The Events Calendar vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤6.18.3Update to 6.18.3.1 | CVE-2026-123464 | |
| Medium6.5 | Unauthenticated Arbitrary Shortcode Execution ≤6.18.3Update to 6.18.3.1 | CVE-2026-123469 | |
| Medium4.3 | Missing Authorization ≤6.18.2Update to 6.18.3 | CVE-2026-119367 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤6.18.2Update to 6.18.3 | CVE-2026-119369 | |
| Medium5.3 | Missing Authorization ≤6.18.2Update to 6.18.3 | CVE-2026-119368 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤6.18.2Update to 6.18.3 | CVE-2026-119370 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤6.18.1Update to 6.18.2 | CVE-2026-110903 | |
| High8.1 | Unauthenticated PHP Object Injection ≤6.17.4Update to 6.17.4.1 | CVE-2026-95606 | |
| Medium4.3 | Missing Authorization ≤6.17.5Update to 6.17.5.1 | CVE-2026-97285 | |
| Medium6.5 | 6.17.5 - Unauthenticated Arbitrary Shortcode Execution 6.12.0 – 6.17.5Update to 6.17.5.1 | CVE-2026-84740 | |
| Medium4.3 | 6.17.4.1 - Missing Authorization 6.15.0 – 6.17.4.1Update to 6.17.5 | CVE-2026-84742 | |
| Medium5.3 | 6.17.4.1 - Unauthenticated Information Exposure 4.5 – 6.17.4.1Update to 6.17.5 | CVE-2026-84741 | |
| Medium4.3 | 6.17.4.1 - Missing Authorization 6.15.16.1 – 6.17.4.1Update to 6.17.5 | CVE-2026-84743 | |
| Critical9.8 | Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation ≤6.17.3Update to 6.17.3.1 | CVE-2026-78159 | |
| Critical9.8 | Unauthenticated PHP Object Injection to Remote Code Execution ≤6.17.4Update to 6.17.4.1 | CVE-2026-78006 | |
| Medium4.3 | Authenticated (Contributor+) Information Exposure <6.17.3.1Update to 6.17.3.1 | CVE-2026-84745 | |
| High8.1 | Unauthenticated PHP Object Injection ≤6.17.2Update to 6.17.3 | CVE-2026-78265 | |
| Medium5.3 | Missing Authorization ≤6.16.5.0Update to 6.16.5.1 | CVE-2026-13390 | |
| High7.5 | Unauthenticated SQL Injection 6.15.12 – 6.16.2Update to 6.16.3 | CVE-2026-49772 | |
| High7.5 | Authenticated (Author+) Arbitrary File Read via ajax_create_import ≤6.15.17Update to 6.15.17.1 | CVE-2026-3585 | |
| Medium5.4 | Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API ≤6.15.16Update to 6.15.16.1 | CVE-2026-2694 | |
| Medium5.4 | Missing Authorization to Authenticated (Subscriber+) Data Migration Control ≤6.15.13Update to 6.15.13.1 | CVE-2025-15043 | |
| Medium4.3 | Missing Authorization ≤6.15.12.2Update to 6.15.13 | CVE-2025-69352 | |
| Medium5.3 | Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure ≤6.15.9Update to 6.15.10 | CVE-2025-12192 | |
| High7.5 | 6.15.9 - Unauthenticated SQL Injection via s 6.15.1.1 – 6.15.9Update to 6.15.10 | CVE-2025-12197 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure ≤6.15.9Update to 6.15.10 | CVE-2025-12175 | |
| Medium5.3 | Missing Authorization to Unauthenticated Password-Protected Information Disclosure ≤6.15.2Update to 6.15.3 | CVE-2025-9808 | |
| High7.5 | Unauthenticated SQL Injection ≤6.15.1Update to 6.15.1.1 | CVE-2025-9807 | |
| Medium6.4 | Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤6.13.2Update to 6.13.2.1 | CVE-2025-5144 | |
| Medium4.3 | Missing Authorization ≤6.11.2.1Update to 6.12.0 | CVE-2025-48246 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤6.9.0Update to 6.9.1 | CVE-2024-12118 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.7.0Update to 6.7.1 | CVE-2025-24537 | |
| Medium5.3 | Missing Authorization to Unauthenticated Password Protected Event Disclosure ≤6.8.2Update to 6.8.2.1 | CVE-2024-5333 | |
| Critical9.8 | Unauthenticated SQL Injection ≤6.6.4Update to 6.6.4.1 | CVE-2024-8275 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤6.6.3Update to 6.6.4 | CVE-2024-8493 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.6.3Update to 6.6.4 | CVE-2024-6931 | |
| Medium4.3 | Cross-Site Request Forgery via action_restore_events ≤6.5.1.4Update to 6.5.1.5 | CVE-2024-37518 | |
| Medium4.3 | Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access ≤6.4.0Update to 6.4.0.1 | CVE-2024-1295 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤6.4.0Update to 6.4.0.1 | CVE-2024-4180 | |
| Medium4.3 | Cross-Site Request Forgery to Notice Dismissal ≤6.3.0Update to 6.3.1 | CVE-2024-31433 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure ≤6.2.8.2Update to 6.2.9 | CVE-2023-6557 | |
| Medium5.3 | Information Disclosure <6.2.8.1Update to 6.2.8.1 | CVE-2023-6203 | |
| Medium4.3 | Missing Authorization ≤6.1.2.2Update to 6.1.3 | CVE-2023-35777 | |
| Medium6.1 | Reflected Cross-Site Scripting via fs_request_get ≤1.9.2No patch available | CVE-2023-33999 | |
| Medium6.3 | Missing Authorization Checks all versionsNo patch available | CVE-2022-4974 | |
| Medium6.1 | Cross-Site Scripting via tribe_paged Parameter <4.8.2Update to 4.8.2 | CVE-2019-15109 | |
| Medium4.7 | Open Redirect ≤4.1.1Update to 4.1.1.1 | — |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.18.3Update to 6.18.3.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤6.18.3Update to 6.18.3.1
- Medium4.3Missing Authorization
≤6.18.2Update to 6.18.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.18.2Update to 6.18.3
- Medium5.3Missing Authorization
≤6.18.2Update to 6.18.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.18.2Update to 6.18.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.18.1Update to 6.18.2
- High8.1Unauthenticated PHP Object Injection
≤6.17.4Update to 6.17.4.1
- Medium4.3Missing Authorization
≤6.17.5Update to 6.17.5.1
- Medium6.56.17.5 - Unauthenticated Arbitrary Shortcode Execution
6.12.0 – 6.17.5Update to 6.17.5.1
- Medium4.36.17.4.1 - Missing Authorization
6.15.0 – 6.17.4.1Update to 6.17.5
- Medium5.36.17.4.1 - Unauthenticated Information Exposure
4.5 – 6.17.4.1Update to 6.17.5
- Medium4.36.17.4.1 - Missing Authorization
6.15.16.1 – 6.17.4.1Update to 6.17.5
- Critical9.8Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
≤6.17.3Update to 6.17.3.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
≤6.17.4Update to 6.17.4.1
- Medium4.3Authenticated (Contributor+) Information Exposure
<6.17.3.1Update to 6.17.3.1
- High8.1Unauthenticated PHP Object Injection
≤6.17.2Update to 6.17.3
- Medium5.3Missing Authorization
≤6.16.5.0Update to 6.16.5.1
- High7.5Unauthenticated SQL Injection
6.15.12 – 6.16.2Update to 6.16.3
- High7.5Authenticated (Author+) Arbitrary File Read via ajax_create_import
≤6.15.17Update to 6.15.17.1
- Medium5.4Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
≤6.15.16Update to 6.15.16.1
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Data Migration Control
≤6.15.13Update to 6.15.13.1
- Medium4.3Missing Authorization
≤6.15.12.2Update to 6.15.13
- Medium5.3Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
≤6.15.9Update to 6.15.10
- High7.56.15.9 - Unauthenticated SQL Injection via s
6.15.1.1 – 6.15.9Update to 6.15.10
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
≤6.15.9Update to 6.15.10
- Medium5.3Missing Authorization to Unauthenticated Password-Protected Information Disclosure
≤6.15.2Update to 6.15.3
- High7.5Unauthenticated SQL Injection
≤6.15.1Update to 6.15.1.1
- Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤6.13.2Update to 6.13.2.1
- Medium4.3Missing Authorization
≤6.11.2.1Update to 6.12.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.9.0Update to 6.9.1
- Medium4.3Cross-Site Request Forgery
≤6.7.0Update to 6.7.1
- Medium5.3Missing Authorization to Unauthenticated Password Protected Event Disclosure
≤6.8.2Update to 6.8.2.1
- Critical9.8Unauthenticated SQL Injection
≤6.6.4Update to 6.6.4.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤6.6.3Update to 6.6.4
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.6.3Update to 6.6.4
- Medium4.3Cross-Site Request Forgery via action_restore_events
≤6.5.1.4Update to 6.5.1.5
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access
≤6.4.0Update to 6.4.0.1
- Medium6.1Reflected Cross-Site Scripting
≤6.4.0Update to 6.4.0.1
- Medium4.3Cross-Site Request Forgery to Notice Dismissal
≤6.3.0Update to 6.3.1
- Medium5.3Unauthenticated Sensitive Information Exposure
≤6.2.8.2Update to 6.2.9
- Medium5.3Information Disclosure
<6.2.8.1Update to 6.2.8.1
- Medium4.3Missing Authorization
≤6.1.2.2Update to 6.1.3
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
- Medium6.3Missing Authorization Checks
all versionsNo patch available
- Medium6.1Cross-Site Scripting via tribe_paged Parameter
<4.8.2Update to 4.8.2
- Medium4.7Open Redirect
≤4.1.1Update to 4.1.1.1
The Events Calendar: common questions
Does The Events Calendar have known vulnerabilities?
Yes. VulnCrest Radar lists 47 known vulnerabilities in The Events Calendar: 3 critical, 7 high, 37 medium. At least one is not fixed in the latest version.
How do I check which version of The Events Calendar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent The Events Calendar vulnerability?
CVE-2026-123464, published Nov 7, 2026: The Events Calendar <= 6.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any The Events Calendar vulnerability listed in CISA KEV?
No. None of the known The Events Calendar vulnerabilities is currently listed in the CISA KEV catalog.