Unknown The Events Calendar vulnerabilities

6 CVEs affecting Unknown The Events Calendar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-84740, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-84745, published 2026-09-05. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such…
CVE-2026-13390, published 2026-07-27. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status…
CVE-2026-84741, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated…
CVE-2026-84743, published 2026-09-23. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor…
CVE-2026-84742, published 2026-09-23. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that…
CVE-2026-84740, published 2026-10-02. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing…