CVE-2025-12175: Stellarwp The Events Calendar

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate/view QR codes for them.

Affected products

• Stellarwp The Events Calendar: up to and including 6.15.9

Published 2025-10-31. Last modified 2026-10-07.