The Events Calendar

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

Published: 2026-09-23T06:00:17.667Z
Updated: 2026-09-23T10:56:36.685Z

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

Published: 2026-09-23T06:00:17.852Z
Updated: 2026-09-23T10:56:22.720Z

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

Published: 2026-09-23T06:00:17.488Z
Updated: 2026-09-23T10:56:51.129Z

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

Published: 2026-09-05T06:00:08.531Z
Updated: 2026-09-06T10:37:23.477Z

The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Published: 2025-05-15T20:07:16.029Z
Updated: 2025-05-17T03:11:43.420Z