The Events Calendar
Nexcess
Developer
6.18.0
Latest version
600,000
Installations
No date
Last updated
Vulnerability history
0 present
40 patched
13 Mitigation rules
- Unauthenticated Arbitrary Shortcode Execution vulnerability6.12.0-6.17.5.015 hours ago
- Broken Access Control vulnerability<= 6.17.53 days ago
- Unauthenticated Non-Public Venue and Organizer Disclosure vulnerability4.5-6.17.423/09/2026
- Contributor+ Content Publication vulnerability6.15.0-6.17.423/09/2026
- Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability6.15.16.1-6.17.423/09/2026
- Unauthenticated PHP Object Injection to Remote Code Execution vulnerability<= 6.17.411/09/2026
- Unauthenticated Code Injection to Remote Code Execution vulnerability<= 6.17.311/09/2026
- Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability< 6.17.3.105/09/2026
- PHP Object Injection vulnerability<= 6.17.224/08/2026
- Unauthenticated Event Aggregator Import Status Manipulation vulnerability< 6.16.5.127/07/2026
- SQL Injection vulnerability6.15.12-6.16.208/06/2026
- Authenticated (Author+) Arbitrary File Read via ajax_create_import vulnerability<= 6.15.1711/03/2026
- Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API vulnerability<= 6.15.1625/02/2026
- Missing Authorization to Authenticated (Subscriber+) Data Migration Control vulnerability<= 6.15.1320/01/2026
- Broken Access Control vulnerability<= 6.15.12.209/01/2026
- WordPress The Events Calendar plugin 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s vulnerability6.15.1.1-6.15.905/11/2025
- Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability<= 6.15.905/11/2025
- Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure vulnerability<= 6.15.931/10/2025
- Missing Authorization to Unauthenticated Password-Protected Information Disclosure vulnerability<= 6.15.215/09/2025
- Unauthenticated SQL Injection vulnerability<= 6.15.111/09/2025
- Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability<= 6.13.211/06/2025
- Broken Access Control Vulnerability<= 6.11.2.119/05/2025
- Admin+ Stored XSS vulnerability< 6.6.419/05/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability<= 6.9.022/01/2025
- Unauthenticated Password Protected Event Disclosure vulnerability< 6.8.2.116/12/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 6.7.009/11/2024
- Unauthenticated Stored Cross-Site Scripting vulnerability<= 6.6.327/09/2024
- Unauthenticated SQL Injection vulnerability<= 6.6.425/09/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 6.5.1.405/07/2024
- Authenticated (Contributor+) Arbitrary Events Access vulnerability< 6.4.0.124/05/2024
- Reflected XSS vulnerability< 6.4.0.115/05/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 6.3.010/04/2024
- Unauthenticated Sensitive Information Exposure vulnerability<= 6.2.8.215/01/2024
- Information Disclosure vulnerability< 6.2.8.122/11/2023
- Broken Access Control vulnerability<= 6.1.2.225/07/2023
- Reflected Cross Site Scripting (XSS) vulnerability<= 6.0.13.119/07/2023
- Sensitive Information Disclosure vulnerability< 5.14.0.428/02/2022
- Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability< 5.14.0.428/02/2022
- Open Redirection<= 4.1.125/04/2016
- Reflected Cross Site Scripting<= 3.001/08/2014