WordPress The Events Calendar Plugin < 6.4.0.1 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: The Events Calendar<\/p>
Link: https:\/\/wordpress.org\/plugins\/the-events-calendar\/#developers<\/p>
Affected Version < 6.4.0.1<\/p>
Fixed in version 6.4.0.1 <\/p>","date":"2024-05-15"},{"id":"675005560fc54997f072cb1a31c291693f62dab4","name":"The Events Calendar <= 6.4.0 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-640-reflected-cross-site-scripting","description":"The The Events Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view_data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-05-14"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"n","score":"9.1","severity":"c","exploitable":"3.9","impact":"5.2"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N","score":"9.1","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"none","exploitable":"3.9","impact":"5.2"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"38621d608400536371cee412a40da727307e79eb7134e29bdca1b94392f436be","name":"The Events Calendar [the-events-calendar] < 6.4.0.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.4.0.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-1295","name":"CVE-2024-1295","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-1295","description":"[en] The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)","date":"2024-06-14"},{"id":"c462b4956c54df8905dad89f410f5a07dbecc156","name":"The Events Calendar Free & Pro <= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/the-events-calendar-free-pro-640-missing-authorization-to-authenticated-contributor-arbitrary-events-access","description":"Multiple plugins and\/or themes for WordPress are vulnerable to unauthorized access of data due to a insufficient capability checks and restrictions on a function in various versions. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary events that they should not have access to.","date":"2024-05-24"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-284","name":"Improper Access Control","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"db87db239e7d6dc6397b67e5d5fcd6f5d4cb12ffe1235b9d1550da381a8c58ae","name":"The Events Calendar [the-events-calendar] < 6.5.1.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.5.1.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-37518","name":"CVE-2024-37518","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-37518","description":"[en] Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n\/a through <= 6.5.1.4.","date":"2025-01-02"},{"id":"2d6f5722933121d477da754f0312c94fafb95b57","name":"WordPress The Events Calendar Plugin <= 6.5.1.4 is vulnerable to Cross Site Request Forgery (CSRF)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/the-events-calendar\/vulnerability\/wordpress-the-events-calendar-plugin-6-5-1-4-cross-site-request-forgery-csrf-vulnerability","description":"
WordPress The Events Calendar Plugin <= 6.5.1.4 is vulnerable to Cross Site Request Forgery (CSRF)<\/p>
Software: The Events Calendar<\/p>
Link: https:\/\/wordpress.org\/plugins\/the-events-calendar\/#developers<\/p>
Affected Version <= 6.5.1.4<\/p>
Fixed in version 6.5.1.5 <\/p>","date":"2024-07-05"},{"id":"be2c11454fc253ad421bd7db9773d74d575acda6","name":"The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6514-cross-site-request-forgery-via-action-restore-events","description":"The The Events Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.5.1.4. This is due to missing or incorrect nonce validation on the action_restore_events() function. This makes it possible for unauthenticated attackers to restore events via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2024-07-05"},{"id":"EUVD-2024-36581","name":"EUVD-2024-36581","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-36581","description":"Cross-Site Request Forgery (CSRF) vulnerability in The Events Calendar The Events Calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n\/a through 6.5.1.4.","date":"2025-01-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"b512b45e8e8654e2e0ade9287a4994333b0dfd8b9ef2725a60f31294028b099d","name":"The Events Calendar [the-events-calendar] < 6.6.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.6.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-6931","name":"CVE-2024-6931","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-6931","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-09-27"},{"id":"d03023cad487630b5658b9fc634124b90e950e15","name":"WordPress The Events Calendar Plugin <= 6.5.1.6 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/vulnerability\/the-events-calendar\/wordpress-the-events-calendar-plugin-6-5-1-6-unauthenticated-stored-cross-site-scripting-vulnerability","description":"
WordPress The Events Calendar Plugin <= 6.5.1.6 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: The Events Calendar<\/p>
Link: https:\/\/wordpress.org\/plugins\/the-events-calendar\/#developers<\/p>
Affected Version <= 6.5.1.6<\/p>
Fixed in version 6.5.2 <\/p>","date":"2024-07-24"},{"id":"fa902b3f34718bf43acbef290f005d92b53f55d5","name":"The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-652-unauthenticated-stored-cross-site-scripting","description":"The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-07-23"},{"id":"ceac669108c7789845ab13f2e9704581615025ab","name":"WordPress The Events Calendar Plugin <= 6.6.3 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/the-events-calendar\/vulnerability\/wordpress-the-events-calendar-plugin-6-6-3-unauthenticated-stored-cross-site-scripting-vulnerability","description":"
WordPress The Events Calendar Plugin <= 6.6.3 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: The Events Calendar<\/p>
Link: https:\/\/wordpress.org\/plugins\/the-events-calendar\/#developers<\/p>
Affected Version <= 6.6.3<\/p>
Fixed in version 6.6.4 <\/p>","date":"2024-09-27"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"747bb3a72ece7d3d44bd2fe687880f35dd58bbf96ae7ea4627973c8770f2d2ef","name":"The Events Calendar [the-events-calendar] < 6.6.4.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.6.4.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-8275","name":"CVE-2024-8275","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-8275","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.","date":"2024-09-25"},{"id":"8cb146b9d121a4413d221eb3f49f697f9100b2b6","name":"WordPress The Events Calendar Plugin <= 6.6.4 is vulnerable to SQL Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/the-events-calendar\/vulnerability\/wordpress-the-events-calendar-plugin-6-6-4-unauthenticated-sql-injection-vulnerability","description":"
WordPress The Events Calendar Plugin <= 6.6.4 is vulnerable to SQL Injection<\/p>
Software: The Events Calendar<\/p>
Link: https:\/\/wordpress.org\/plugins\/the-events-calendar\/#developers<\/p>
Affected Version <= 6.6.4<\/p>
Fixed in version 6.6.4.1 <\/p>","date":"2024-09-25"},{"id":"77e645b06d84e736a29d3ef4bab06955dd80fb37","name":"The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-664-unauthenticated-sql-injection","description":"The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.","date":"2024-09-24"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"3.9","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"3.9","impact":"5.9"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"d723f123178f1b5f155aa402e5039e095d6fbc1270cd0bb369cdad21b0ab57c2","name":"The Events Calendar [the-events-calendar] < 6.6.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.6.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-8493","name":"The Events Calendar < 6.6.4 - Admin+ Stored XSS","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-8493","description":"The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"0000-00-00"},{"id":"ee4f00ee8b15a5a79c90903383f4c5b2504d09a6","name":"The Events Calendar <= 6.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-663-authenticated-administrator-stored-cross-site-scripting","description":"The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-07-31"},{"id":"EUVD-2025-15219","name":"EUVD-2025-15219","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-15219","description":"The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-05-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"359bc9f81e0b10ec668395223cbf88d292da81ae3243607eb417127cc46e54c2","name":"The Events Calendar [the-events-calendar] < 6.8.2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.8.2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-5333","name":"CVE-2024-5333","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5333","description":"[en] The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.","date":"2024-12-16"},{"id":"2f140f6c4898f0ce4d76b079956ec9807af24e16","name":"WordPress The Events Calendar Plugin < 6.8.2.1 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/the-events-calendar\/vulnerability\/wordpress-the-events-calendar-plugin-6-8-2-1-unauthenticated-password-protected-event-disclosure-vulnerability","description":"
WordPress The Events Calendar Plugin < 6.8.2.1 is vulnerable to Broken Access Control<\/p>
Software: The Events Calendar<\/p>
Fixed in version 6.8.2.1 <\/p>
Affected Version < 6.8.2.1<\/p>
CVE: CVE-2024-5333<\/p>","date":"2024-12-16"},{"id":"63ff8eeb024979ed2cb77a2484f6fa7d88224eb9","name":"The Events Calendar <= 6.8.2 - Missing Authorization to Unauthenticated Password Protected Event Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-682-missing-authorization-to-unauthenticated-password-protected-event-disclosure","description":"The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.8.2 via the \/wp-json\/tribe\/events\/v1\/events\/ REST API due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected events that they should not have access to.","date":"2024-11-25"},{"id":"EUVD-2024-47146","name":"EUVD-2024-47146","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-47146","description":"The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.","date":"2024-12-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.001"}},{"uuid":"d39f96f321593ba8ab41d1cefdaee2bb4a39bc2e1deeddc12c8fc45b7ef89ee4","name":"The Events Calendar [the-events-calendar] < 6.9.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.9.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-12118","name":"CVE-2024-12118","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-12118","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-01-23"},{"id":"767b1ebc3f7bbdfedbf18c57b91fee294d17c11e","name":"The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-690-authenticated-contributor-stored-cross-site-scripting","description":"The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-01-22"},{"id":"EUVD-2024-50610","name":"EUVD-2024-50610","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-50610","description":"The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-01-23"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"6.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"996d5bf3dcaf6f4b5ef6474d6192cf3e78db212c0cc6da85c0956dde4bc9c972","name":"The Events Calendar [the-events-calendar] < 6.7.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.7.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-24537","name":"CVE-2025-24537","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-24537","description":"[en] Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The Events Calendar: from n\/a through <= 6.7.0.","date":"2025-01-27"},{"id":"EUVD-2025-3749","name":"EUVD-2025-3749","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-3749","description":"Cross-Site Request Forgery (CSRF) vulnerability in The Events Calendar The Events Calendar allows Cross Site Request Forgery. This issue affects The Events Calendar: from n\/a through 6.7.0.","date":"2025-01-27"},{"id":"2267a1d9494c64af1cf31208480769357fe09a88","name":"The Events Calendar <= 6.7.0 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-670-cross-site-request-forgery","description":"The The Events Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown.","date":"2025-01-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"l","score":"5.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"4709d34d3a08b4a12a720c912fecd69ae0d9d49b313e9540ce5355b0c3ac4776","name":"The Events Calendar [the-events-calendar] < 6.12.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.12.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-48246","name":"CVE-2025-48246","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-48246","description":"[en] Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Events Calendar: from n\/a through 6.11.2.1.","date":"2025-05-19"},{"id":"aadc23fada3301622848143fa53ec4c00b237ef5","name":"The Events Calendar <= 6.11.2.1 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61121-missing-authorization","description":"The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_preview_import() function in versions up to, and including, 6.11.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to create an import.","date":"2025-05-19"},{"id":"EUVD-2025-28166","name":"EUVD-2025-28166","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-28166","description":"Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Events Calendar: from n\/a through 6.11.2.1.","date":"2025-05-19"}],"impact":{"cvss":{"version":null,"vector":null,"av":null,"ac":null,"pr":null,"ui":null,"s":null,"c":null,"i":null,"a":null,"score":"0.0","severity":null,"exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"low","exploitable":null,"impact":null},"epss":"0.001"}},{"uuid":"3468cd59a996b66af5c427d2dce6b7f31d2c0f165ad5f444570ec3b5a7c079c8","name":"The Events Calendar [the-events-calendar] < 6.13.2.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.13.2.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-5144","name":"The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-5144","description":"The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018data-date-*\u2019 parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"0000-00-00"},{"id":"4fb731a94777c7a76dcc26c3b9b28622575b2f72","name":"The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6132-authenticated-contributor-dom-based-stored-cross-site-scripting","description":"The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018data-date-*\u2019 parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-06-10"},{"id":"EUVD-2025-18097","name":"EUVD-2025-18097","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-18097","description":"The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018data-date-*\u2019 parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-06-11"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.001"}},{"uuid":"cc1a28f2547c7c55669bdb196a1a4638dc045d58b55d88f484a8d27ede9cf75c","name":"The Events Calendar [the-events-calendar] < 6.15.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-12175","name":"CVE-2025-12175","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-12175","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate\/view QR codes for them.","date":"2025-10-31"},{"id":"9ffec3061f0db7ab4e15716a9b03385dea0a320a","name":"The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title\/QR Code Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6159-missing-authorization-to-authenticated-subscriber-draft-event-titleqr-code-exposure","description":"The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate\/view QR codes for them.","date":"2025-10-30"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"28a7967896063769846e53b18d45cc85e1711987ac8a88cfef5b1e1fba4d479d","name":"The Events Calendar [the-events-calendar] < 6.15.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-12192","name":"CVE-2025-12192","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-12192","description":"[en] The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever \"Yes, automatically share my system information with The Events Calendar support team\" setting is enabled.","date":"2025-11-05"},{"id":"bf98a57f995475611dc5900fd1a9a5bcabeb8553","name":"The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6159-sysinfo-key-incorrect-comparison-to-unauthenticated-sensitive-information-exposure","description":"The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever \"Yes, automatically share my system information with The Events Calendar support team\" setting is enabled.","date":"2025-11-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-697","name":"Incorrect Comparison","description":"The product compares two entities in a security-relevant context, but the comparison is incorrect."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"18c75b5beb6f371c3041f62caae2ecf94c6b91c3f43912059295cf42351c7ddb","name":"The Events Calendar [the-events-calendar] < 6.15.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-12197","name":"CVE-2025-12197","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-12197","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2025-11-05"},{"id":"ed0a9414b6e7a39d0f8bc9d81a5d719201bad72c","name":"The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61511-6159-unauthenticated-sql-injection-via-s","description":"The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2025-11-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"7.5","severity":"h","exploitable":"3.9","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"3.9","impact":"3.6"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"2e665139d51707c560d0134627dbc4e445355a1d8db628092d3ed499401457fa","name":"The Events Calendar [the-events-calendar] < 6.15.13","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.13","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-69352","name":"CVE-2025-69352","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-69352","description":"[en] Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n\/a through <= 6.15.12.2.","date":"2026-01-06"},{"id":"09f8aca27073698a70dd4b5051a15faa062f639b","name":"The Events Calendar <= 6.15.12.2 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-615122-missing-authorization","description":"The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.15.12.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.","date":"2026-01-09"},{"id":"EUVD-2026-0955","name":"EUVD-2026-0955","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-0955","description":"Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n\/a through <= 6.15.12.2.","date":"2026-01-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"l","score":"5.4","severity":"m","exploitable":"2.8","impact":"2.5"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"low","exploitable":"2.8","impact":"2.5"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"97309696e9e90660fd6b72ba8c38da3a94ca204ec034819c6b43eb2836ec824a","name":"The Events Calendar [the-events-calendar] < 6.15.13.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.13.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-15043","name":"CVE-2025-15043","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-15043","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with subscriber level access and above, to start, cancel, or revert the Custom Tables V1 database migration, including dropping the custom database tables entirely via the revert action.","date":"2026-01-20"},{"id":"d59b35c475f209bc94a7db2a6a1ce1a9009f690b","name":"The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61513-missing-authorization-to-authenticated-subscriber-data-migration-control","description":"The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with subscriber level access and above, to start, cancel, or revert the Custom Tables V1 database migration, including dropping the custom database tables entirely via the revert action.","date":"2026-01-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"l","score":"5.4","severity":"m","exploitable":"2.8","impact":"2.5"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"low","exploitable":"2.8","impact":"2.5"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"050b928d2a66c6cd20969467f8bf4f79aa0784ed291dde0beb022700dbf7d691","name":"The Events Calendar [the-events-calendar] < 6.15.17.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.17.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-3585","name":"The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-3585","description":"The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.","date":"0000-00-00"},{"id":"bf7b09371db1f4e7b3e1f9651f34fb2f6824754e","name":"The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61517-authenticated-author-arbitrary-file-read-via-ajax-create-import","description":"The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.","date":"2026-03-09"}],"impact":{"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"6dbd71971ce788124bef7210005e4a7715cc0b651a4626c0517073f219d347e0","name":"The Events Calendar [the-events-calendar] < 6.15.16.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.16.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-2694","name":"The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event\/Organizer\/Venue Update\/Trash via REST API","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-2694","description":"The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.","date":"0000-00-00"},{"id":"f7bda285c287769f414770ff5a182d9e3fe48a34","name":"The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event\/Organizer\/Venue Update\/Trash via REST API","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61516-improper-authorization-to-authenticated-contributor-eventorganizervenue-updatetrash-via-rest-api","description":"The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.","date":"2026-02-25"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"488e2574e9ff7bba97052cb2cfc62a14250a53a43108e2249936e83a06308d63","name":"The Events Calendar [the-events-calendar] < 6.15.1.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.1.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-9807","name":"The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-9807","description":"The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018s\u2019 parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"0000-00-00"},{"id":"0f0cc86c5b907bbedeeb6c2702bb32818b37a68d","name":"The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6151-unauthenticated-sql-injection","description":"The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018s\u2019 parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2025-09-11"},{"id":"EUVD-2025-29002","name":"EUVD-2025-29002","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-29002","description":"The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018s\u2019 parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2025-09-12"}],"impact":{"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":null,"impact":null},"epss":"0.001"}},{"uuid":"bd61a4b21171b45898eb6689790f18a8b6428dd487ac5c35fc448c1bad0a0a19","name":"The Events Calendar [the-events-calendar] < 6.15.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.15.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-9808","name":"The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-9808","description":"The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.","date":"0000-00-00"},{"id":"e6b8947e9e986867da75ae482c00656a8b3ec113","name":"The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6152-missing-authorization-to-unauthenticated-password-protected-information-disclosure","description":"The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.","date":"2025-09-15"},{"id":"EUVD-2025-29359","name":"EUVD-2025-29359","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-29359","description":"The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.","date":"2025-09-16"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":null,"impact":null}}},{"uuid":"12048f2ac6b4da59712075420c1984662d02d36a77b36026730d5c3da0106425","name":"The Events Calendar [the-events-calendar] < 6.16.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.16.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-49772","name":"CVE-2026-49772","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-49772","description":"[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web \/ StellarWP The Events Calendar allows Blind SQL Injection.\n\nThis issue affects The Events Calendar: from 6.15.12 through 6.16.2.","date":"2026-06-16"},{"id":"ca0f4af97cb7d168637d17d6282e4a5caed64f28","name":"The Events Calendar 6.15.12-6.16.2 - Unauthenticated SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61512-6162-unauthenticated-sql-injection","description":"The The Events Calendar plugin for WordPress is vulnerable to SQL Injection in versions up to 6.15.12-6.16.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2026-06-08"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:L","av":"n","ac":"l","pr":"n","ui":"n","s":"c","c":"h","i":"n","a":"l","score":"9.3","severity":"c","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:L","score":"9.3","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"changed","c":"high","i":"none","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"4299f237343d1d405f79461301d92330fabc6c37c5bfcb3a5f3b9eb9d5d49e40","name":"The Events Calendar [the-events-calendar] < 6.16.5.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.16.5.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-13390","name":"The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-13390","description":"The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.","date":"0000-00-00"},{"id":"86a8ce25f8697ef425b0cfdfa8d5edf2da3c41c3","name":"The Events Calendar <= 6.16.5.0 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61650-missing-authorization","description":"The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.16.5.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.","date":"2026-07-06"}],"impact":{"ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"d7df9c1d393c11739a9d711720c97ea6bf9def006eac6da0ab90f83772bbb4db","name":"The Events Calendar [the-events-calendar] < 6.17.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.17.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-78265","name":"CVE-2026-78265","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-78265","description":"[en] Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.","date":"2026-08-24"},{"id":"EUVD-2026-65172","name":"EUVD-2026-65172","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-65172","description":"Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.","date":"2026-08-25"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"f737592a58a7033a0d02a8ee5559e46041b1d6810220d1032b6267e9b2e2f144","name":"The Events Calendar [the-events-calendar] < 6.17.3.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.17.3.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-84745","name":"CVE-2026-84745","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-84745","description":"[en] The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.","date":"2026-09-05"},{"id":"f73500ea381cec08827646045b750c33c8e62f3e","name":"The Events Calendar < 6.17.3.1 - Authenticated (Contributor+) Information Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-61731-authenticated-contributor-information-exposure","description":"The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 6.17.3.1. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user or configuration data.","date":"2026-08-24"}],"impact":{"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"1310999c3ee47c0851c30c078f46093008c76ccf4ee086696f3a3ce4722193ea","name":"The Events Calendar [the-events-calendar] < 6.17.4.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.17.4.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-78006","name":"CVE-2026-78006","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-78006","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.","date":"2026-09-12"},{"id":"dc799d67d8f72bdf09c92111d16d18c1dd80d8cc","name":"The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6174-unauthenticated-php-object-injection-to-remote-code-execution","description":"The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.","date":"2026-09-11"},{"id":"EUVD-2026-76832","name":"EUVD-2026-76832","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-76832","description":"The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.","date":"2026-09-12"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","kev":false,"kev_date":null},"epss":"0.008"}},{"uuid":"663cb6ac73aa240520a7897ff9ceb97f5dd6bbab92e4cfc24a48c4b0f4125688","name":"The Events Calendar [the-events-calendar] < 6.17.3.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.17.3.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-78159","name":"CVE-2026-78159","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-78159","description":"[en] The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.","date":"2026-09-12"},{"id":"0c2cb7fc2fea2bcaee22616f94107ca08e0c700b","name":"The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/the-events-calendar\/the-events-calendar-6173-unauthenticated-code-injection-to-remote-code-execution-via-widget-classes-map-callable-invocation","description":"The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.","date":"2026-09-11"},{"id":"EUVD-2026-76833","name":"EUVD-2026-76833","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-76833","description":"The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.","date":"2026-09-12"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","kev":false,"kev_date":null},"epss":"0.008"}}]},"updated":"1789280274"}