Known vulnerabilities in StellarWP The Events Calendar
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-78006 | The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and… | 9.8 Critical | Sep 12, 2026 |
| CVE-2026-78159 | The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and… | 9.8 Critical | Sep 12, 2026 |
| CVE-2026-3585 | The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including,… | 7.5 High | Mar 10, 2026 |
| CVE-2026-2694 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due… | 5.4 Medium | Feb 25, 2026 |
| CVE-2025-15043 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on… | 5.4 Medium | Jan 20, 2026 |
| CVE-2025-69352 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly… | 5.4 Medium | Jan 6, 2026 |
| CVE-2025-12192 | The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including,… | 5.3 Medium | Nov 5, 2025 |
| CVE-2025-12197 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions… | 7.5 High | Nov 5, 2025 |
| CVE-2025-12175 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on… | 4.3 Medium | Oct 31, 2025 |
| CVE-2025-9808 | The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including,… | 5.3 Medium | Sep 16, 2025 |
| CVE-2025-9807 | The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all… | 7.5 High | Sep 12, 2025 |
| CVE-2025-5144 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’… | 6.4 Medium | Jun 11, 2025 |
| CVE-2025-48246 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly… | 5.4 Medium | May 19, 2025 |
| CVE-2025-24537 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site… | 5.4 Medium | Jan 27, 2025 |
| CVE-2024-12118 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link… | 6.4 Medium | Jan 23, 2025 |
| CVE-2024-37518 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site… | 4.3 Medium | Jan 2, 2025 |
| CVE-2022-4974 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… | 6.3 Medium | Oct 16, 2024 |
| CVE-2024-6931 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all… | 7.2 High | Sep 27, 2024 |
| CVE-2024-8275 | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the… | 9.8 Critical | Sep 25, 2024 |
| CVE-2024-31433 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar.This issue… | 4.3 Medium | Apr 15, 2024 |
| CVE-2023-6557 | The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,… | 5.3 Medium | Feb 5, 2024 |
Other StellarWP products
GiveWP – Donation Plugin and Fundraising Platform 34
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor 30
GiveWP 10
Event Tickets and Registration 8
Membership Plugin – Restrict Content 7
LearnDash LMS 7
WPComplete 4
Kadence WooCommerce Email Designer 4
Bookit — Booking & Appointment Calendar 3
Gutenberg Blocks by Kadence Blocks 3
Event Tickets 3
Restrict Content 2