CVE-2026-84741: Unknown The Events Calendar

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

Affected products

• Unknown The Events Calendar: from 4.5, before 6.17.5 (fixed in 6.17.5)

Published 2026-09-23. Last modified 2026-09-23.