9.8
Critical
CVE-2026-78265 Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions
Description
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| The Events Calendar 6.17 | earliest → 6.17.2 | No fix stated |