Advisories · Technology
stellarwp The Events Calendar.
Every CVE that names stellarwp The Events Calendar among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
- stellarwp The Events Calendar
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
- stellarwp The Events Calendar
- Insecure deserialization
- CVSS 7.5 High
The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import
- stellarwp The Events Calendar
- Path traversal
- CVSS 5.4 Medium
The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
- stellarwp The Events Calendar
- Broken access control
- CVSS 5.4 Medium
The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
- stellarwp The Events Calendar
- Broken access control
- CVSS 5.4 Medium
WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability
- StellarWP The Events Calendar
- Broken access control
- CVSS 5.3 Medium
The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
- stellarwp The Events Calendar
- CWE-697
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s
- stellarwp The Events Calendar
- SQL injection
- CVSS 4.3 Medium
The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
- stellarwp The Events Calendar
- Broken access control
- CVSS 5.3 Medium
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
- stellarwp The Events Calendar
- Information disclosure
- CVSS 7.5 High
The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection
- stellarwp The Events Calendar
- SQL injection
- CVSS 6.4 Medium
The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- stellarwp The Events Calendar
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability
- StellarWP The Events Calendar
- Broken access control
- CVSS 5.4 Medium
WordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability
- StellarWP The Events Calendar
- Cross-site request forgery (CSRF)
- CVSS 6.4 Medium
The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- stellarwp The Events Calendar
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability
- StellarWP The Events Calendar
- Cross-site request forgery (CSRF)
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting
- stellarwp The Events Calendar
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection
- stellarwp The Events Calendar
- SQL injection
- CVSS 4.3 Medium
WordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability
- StellarWP The Events Calendar
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure
- stellarwp The Events Calendar
- Broken access control