Advisories · Technology
The Events Calendar.
Every CVE that names The Events Calendar among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
- The Events Calendar
- Other injection
- CVSS 3.8 Low
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
- The Events Calendar
- Broken access control
- CVSS 2.7 Low
The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API
- The Events Calendar
- Broken access control
- CVSS 5.3 Medium
The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API
- The Events Calendar
- Information disclosure
- CVSS 2.7 Low
The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
- The Events Calendar
- Information disclosure
- CVSS 5.3 Medium
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
- The Events Calendar
- Broken access control
- CVSS 4.8 Medium
The Events Calendar < 6.6.4 - Admin+ Stored XSS
- The Events Calendar
- CVSS 5.3 Medium
The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
- The Events Calendar
- CVSS 5.3 Medium
WordPress The Events Calendar plugin <= 6.1.2.2 - Broken Access Control vulnerability
- The Events Calendar
- Broken access control
- CVSS 6.5 Medium
The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access
- events-calendar-pro
- The Events Calendar
- CVSS 9.1 CriticalCritical · CVSS 9+
The Events Calendar < 6.4.0.1 - Reflected XSS
- The Events Calendar
-
The Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read
- The Events Calendar