Vulnerabilities / The Events Calendar
The Events Calendar vulnerabilities
Advisories WPSec published for The Events Calendar. Other sources may list more. Its attack surface: The Events Calendar on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-16 | WPSEC-2026-1140 | The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Widget HTML Tag Settings | Medium 6.4 | 6.18.2 |
| 2026-10-14 | WPSEC-2026-0970 | The Events Calendar <= 6.18.0 - Unauthenticated Denial of Service via 'posts_per_page' Parameter | Medium 5.3 | 6.18.1 |
| 2026-10-02 | WPSEC-2026-0235 | The Events Calendar <= 6.17.5 - Authenticated (Contributor+) Missing Authorization to Event, Venue and Organizer Author Assignment via REST API | Medium 4.3 | 6.17.5.1 |
| 2026-10-02 | WPSEC-2026-0234 | The Events Calendar <= 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via Events QR Code Widget | High 7.3 | 6.17.5.1 |
License: CC BY 4.0