The Events Calendar
StellarWP
Developer
6.15.17
Latest version
700,000
Installations
No date
Last updated
Vulnerability history
0 present
28 patched
7 Mitigation rules
- Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API vulnerability<= 6.15.165 days ago
- Missing Authorization to Authenticated (Subscriber+) Data Migration Control vulnerability<= 6.15.13Jan 20, 2026
- Broken Access Control vulnerability<= 6.15.12.2Jan 9, 2026
- WordPress The Events Calendar plugin 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s vulnerability6.15.1.1-6.15.9Nov 5, 2025
- Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability<= 6.15.9Nov 5, 2025
- Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure vulnerability<= 6.15.9Oct 31, 2025
- Missing Authorization to Unauthenticated Password-Protected Information Disclosure vulnerability<= 6.15.2Sep 15, 2025
- Unauthenticated SQL Injection vulnerability<= 6.15.1Sep 11, 2025
- Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability<= 6.13.2Jun 11, 2025
- Broken Access Control Vulnerability<= 6.11.2.1May 19, 2025
- Admin+ Stored XSS vulnerability< 6.6.4May 19, 2025
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 6.9.0Jan 22, 2025
- Unauthenticated Password Protected Event Disclosure vulnerability< 6.8.2.1Dec 16, 2024
- Cross Site Request Forgery (CSRF) vulnerability<= 6.7.0Nov 9, 2024
- Unauthenticated Stored Cross-Site Scripting vulnerability<= 6.6.3Sep 27, 2024
- Unauthenticated SQL Injection vulnerability<= 6.6.4Sep 25, 2024
- Cross Site Request Forgery (CSRF) vulnerability<= 6.5.1.4Jul 5, 2024
- Authenticated (Contributor+) Arbitrary Events Access vulnerability< 6.4.0.1May 24, 2024
- Reflected XSS vulnerability< 6.4.0.1May 15, 2024
- Cross Site Request Forgery (CSRF) vulnerability<= 6.3.0Apr 10, 2024
- Unauthenticated Sensitive Information Exposure vulnerability<= 6.2.8.2Jan 15, 2024
- Information Disclosure vulnerability< 6.2.8.1Nov 22, 2023
- Broken Access Control vulnerability<= 6.1.2.2Jul 25, 2023
- Reflected Cross Site Scripting (XSS) vulnerability<= 6.0.13.1Jul 19, 2023
- Sensitive Information Disclosure vulnerability< 5.14.0.4Feb 28, 2022
- Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability< 5.14.0.4Feb 28, 2022
- Open Redirection<= 4.1.1Apr 25, 2016
- Reflected Cross Site Scripting<= 3.0Aug 1, 2014