CVE-2026-119367
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Events Calendar (the-events-calendar) plugin contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 6.18.2. This may enable unauthorized access to features or data.
Risk Assessment
An unauthorized user may gain access to features or data they should not have rights to, breaching confidentiality or integrity. This could lead to modification of event content or disclosure of information.
Recommendation
Update The Events Calendar plugin to a version later than 6.18.2 to fix the missing authorization vulnerability.
Other vulnerabilities in The Events Calendar
See all- CVE-2026-110903Medium
The Events Calendar plugin contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 6.18.1.
- CVE-2026-97285Medium
The Events Calendar plugin in versions up to and including 6.17.5 contains a Broken Access Control vulnerability exploitable by a user with Contributor privileges. This allows bypassing access control mechanisms.
- CVE-2026-95606Critical
Deserialization of untrusted data vulnerability in The Events Calendar plugin allows object injection. Affects versions up to 6.17.4.
- CVE-2026-78159Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.3 is vulnerable to Remote Code Execution via the parse_array function. Insufficient validation of the widget 'classes' map allows a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This enables unauthenticated attackers to execute code on the server, provided comments are enabled on tribe_events posts and at least one comment containing a crafted wp:legacy-widget block has been submitted.
- CVE-2026-78006Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.4 is vulnerable to Remote Code Execution via the is_safe_widget_instance function. Insufficient protection in is_safe_widget_instance can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This enables unauthenticated attackers to execute code on the server, as the plugin's V2 single-event template runs do_blocks() over buffered comment HTML and WordPress returns a moderation-hash URL allowing an unauthenticated commenter to immediately view their own pending comment.
- CVE-2026-78265Critical
Unauthenticated PHP Object Injection in The Events Calendar versions up to 6.17.2.
- CVE-2026-119369Medium
The Events Calendar plugin (Liquid Web / StellarWP) through 6.18.2 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed for users viewing the page.
- CVE-2026-119370Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS. This issue affects The Events Calendar: from n/a through 6.18.2.
- CVE-2026-119368Medium
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Events Calendar: from n/a through 6.18.2.
- CVE-2026-84740Medium
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Original NVD description (English source)
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS