The Events Calendar vulnerabilities
6 known vulnerabilities in The Events Calendar from StellarWP. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
The Events Calendar: Improper Control of Generation of Code
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to
- 9.8 Critical severity
The Events Calendar: Deserialization of Untrusted Data
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed
- 7.5 High severity
The Events Calendar: Improper Limitation of a Pathname to a Restricted Directory
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read th
- 7.5 High severity
The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command
The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi
- 7.5 High severity
The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis
- 9.8 Critical severity
The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of suf