The Events Calendar <= 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via Events QR Code Widget
- ID
- WPSEC-2026-0234
- Plugin
- The Events Calendar (the-events-calendar)
- Affected
- from 6.12.0 before 6.17.5.1
- Remediation
- Update to 6.17.5.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The The Events Calendar plugin for WordPress is vulnerable to arbitrary shortcode execution via the Events QR Code widget view in all versions from 6.12.0 up to, and including, 6.17.5. This is due to the widget template concatenating the redirection mode, event or series ID and size values into a shortcode string passed to do_shortcode(), with esc_attr() not neutralizing square brackets, while those values can be supplied in the request when the widget view is rendered through the public Views V2 HTML endpoint (REST route tribe/views/v2/html or its tribe_events_views_v2_fallback AJAX fallback). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
References
- https://wpsec.com/vuln/WPSEC-2026-0234/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.17.5.1/
- https://wordpress.org/plugins/the-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS