The Events Calendar, CVE-2026-84740

CVE, Research URL: CVE-2026-84740
Home page URL: Security reports for The Events Calendar
Application: The Events Calendar
Published on: Oct 02, 2026
Research Description: The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected versions: Min 6.12.0, max 6.17.5.1.
Status: vulnerable