The Events Calendar
Approved changes feed: RSS · Atom
cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Stellarwp (85cedc32-4162-5fac-82cb-4647b1b8e38d) |
|---|---|
| Product | The Events Calendar (ad87ccc0-15db-50a2-b4f1-739687656c97) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/the-events-calendar/the-events-calendar |
purl2cpe | 2026-06-01 10:12:26.496308 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3585 |
vulnerable | 2026-06-08 08:01:18.999535 |
The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import
HIGH (7.5)
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Published: 2026-03-10T03:33:51.369Z
Updated: 2026-04-08T17:09:33.116Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2694 |
vulnerable | 2026-06-08 07:55:17.393422 |
The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
MEDIUM (5.4)
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.
Published: 2026-02-25T21:25:02.211Z
Updated: 2026-04-08T16:58:09.763Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9808 |
vulnerable | 2026-06-08 07:47:09.960840 |
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
MEDIUM (5.3)
The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.
Published: 2025-09-16T05:25:26.060Z
Updated: 2026-04-08T16:35:38.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9807 |
vulnerable | 2026-06-08 07:47:09.960421 |
The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection
HIGH (7.5)
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-09-12T01:46:00.820Z
Updated: 2026-04-08T17:06:25.893Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-69352 |
vulnerable | 2026-06-08 07:43:13.485029 |
WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability
MEDIUM (5.4)
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2.
Published: 2026-01-06T16:36:40.651Z
Updated: 2026-04-28T16:14:38.638Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5144 |
vulnerable | 2026-06-08 07:35:24.256574 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48246 |
vulnerable | 2026-06-08 07:27:15.600245 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24537 |
vulnerable | 2026-06-08 07:12:49.471597 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-15043 |
vulnerable | 2026-06-08 07:06:35.599484 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12197 |
vulnerable | 2026-06-08 07:04:29.830082 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12192 |
vulnerable | 2026-06-08 07:04:29.806493 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12175 |
vulnerable | 2026-06-08 07:04:29.789343 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8275 |
vulnerable | 2026-06-08 07:00:23.472802 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6931 |
vulnerable | 2026-06-08 06:58:20.778509 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37518 |
vulnerable | 2026-06-08 06:39:47.765276 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31433 |
vulnerable | 2026-06-08 06:35:31.530813 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12118 |
vulnerable | 2026-06-08 06:23:51.296167 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6557 |
vulnerable | 2026-06-08 06:21:54.854146 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35777 |
vulnerable | 2026-06-08 06:06:27.563240 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4974 |
vulnerable | 2026-06-08 05:52:02.456376 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.