WordPress security by component
The Events Calendar
Plugin description
The Events Calendar is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 8.8.
Plugin slug:
events-calendarLatest vulnerability
CVE-2026-13390: Events Calendar import route permits unauthenticated import tampering
The Events Calendar before 6.16.5.1 omits authentication from an Event Aggregator import REST route and skips an integrity check for one import status. An unauthenticated attacker can mark imports as failed and store arbitrary content in a hidden comment, disrupting aggregation and creating a persistent content primitive. The CNA record does not identify the REST route, status value, parameters or handler function.
Known source slugs: events-calendar, events-calendar*
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-13390
Events Calendar import route permits unauthenticated import tampering
The Events Calendar before 6.16.5.1 omits authentication from an Event Aggregator import REST route and skips an integrity check for one import status. An unauthenticated attacker can mark imports as failed and store arbitrary content in a hidden comment, disrupting aggregation and creating a persistent content primitive. The CNA record does not identify the REST route, status value, parameters or handler function.
|
6.16.5.1 |
CVE5.3
NVDPending
|
| Nov 05, 2025 |
CVE-2025-12192
Events Calendar: Sensitive information exposure
Events Calendar is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| May 15, 2025 |
CVE-2024-8701
events-calendar: Cross-site scripting
events-calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVDPending
|
| Mar 03, 2025 |
CVE-2025-26967
Events Calendar for GeoDirectory: Code execution
Events Calendar for GeoDirectory is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVD8.8
|